ClawHub
Back to skill

Security audit

Vision-Action-Evolution Loop

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill is not malicious, but it describes physical robot actions, recurring work, and self-updating memory without enough safety limits or user control.

Review before installing if there is any chance this skill could be connected to robotics, automation, files, or external tools. Use it only in a scoped workspace, require explicit human confirmation before any real-world action, disable or tightly control heartbeat tasks, and inspect any separate implementation code before enabling persistent memory or hardware control.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README explicitly promotes a loop that progresses from perception and planning to physical execution and iterative self-improvement, but it provides no safety constraints, operator approval requirements, environment assumptions, or warnings about possible effects on devices, surrounding objects, or downstream systems. In a skill intended to generate actions from visual input, omission of user-facing safety guidance can encourage unsafe deployment and misuse, especially because the description frames the system as becoming stronger through repeated use.

Static analysis

No suspicious patterns detected.