ClawHub
Back to skill

Security audit

Compliance Gap Filler

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward external API skill for compliance gap recommendations, with the main caution that submitted gap details may contain sensitive security posture information.

Before installing, confirm that your organization permits sending compliance control gaps to this third-party API. Avoid submitting confidential audit reports, detailed vulnerabilities, customer data, or regulated information unless you have approval and understand the provider's handling and retention practices.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes collecting compliance gap details and sending them to a third-party API, but it does not clearly warn users that potentially sensitive security and audit posture data will leave their environment. Compliance gaps, missing controls, and remediation context can reveal weaknesses in an organization's defenses, so undisclosed external transmission creates confidentiality and governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill references an external API endpoint, confirming that user-provided compliance data is transmitted off-platform to a remote service. In this context, the data may include missing security controls and audit deficiencies, which could expose an organization's security posture if the service is compromised, logs requests insecurely, or is used without user awareness.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
## References

- **Kong Route:** https://api.mkkpro.com/compliance/gap-filler
- **API Docs:** https://api.mkkpro.com:8024/docs

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The operation is described only as 'Fill Gaps', which does not meaningfully constrain when an agent should invoke it or what safety boundaries apply. In agentic contexts, vague action descriptions can cause over-broad or inappropriate tool use on sensitive compliance data, increasing the chance of unintended data handling or misleading automated recommendations.

Content

No source excerpt is available for this finding.