ClawHub
Back to skill

Security audit

DiePre Vision Cognition

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only vision inspection skill discloses local quality-control logging and shows no hidden code, credential use, or data transfer.

Install this as a workflow/template rather than a reviewed runnable vision engine. Before using it with real production images, review any separate code or model files, keep vision_log in a controlled workspace, define retention/deletion rules, and avoid logging raw images or sensitive manufacturing identifiers unless necessary.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README explicitly states that all detection results are written to logs as a form of persistent quality-inspection memory, but it provides no limits, retention policy, access controls, or warning about sensitive manufacturing or image-derived data. In an industrial vision setting, logs may contain product images, defect metadata, operator annotations, timestamps, and production identifiers, which can expose proprietary process information or personal data if stored insecurely or retained indefinitely.

Missing User Warnings

Low
Confidence
94% confidence
Finding
The skill explicitly states that each detection result is written to a dated JSONL log file, but the documentation does not warn users that analysis outputs will be persisted. In a manufacturing and quality-control context, those logs may contain sensitive production metadata, defect records, filenames, or image-derived operational information, creating an avoidable privacy and data-retention risk.

Static analysis

No suspicious patterns detected.