ClawHub
Back to skill

Security audit

Breathing Exercise

Security checks for vulnerabilities and agentic risk

Overview

The skill appears coherent and low risk, with one unnecessary-looking curl dependency that users should notice before installing.

Before installing, check whether the skill actually needs curl. If you want a strictly local breathing aid, prefer a version without network-capable dependencies or inspect the skill text for any command that fetches remote content or sends data out.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The manifest declares a dependency on the external binary `curl`, which is not justified by the stated purpose of a local breathing exercise skill. Unnecessary network-capable tools expand the attack surface by enabling outbound requests, remote content retrieval, or data exfiltration if later invoked by the skill or related tooling.

Static analysis

No suspicious patterns detected.