ClawHub
Back to skill

Security audit

Drone Engineer

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward external API skill for generating drone-engineering career roadmaps, with privacy-disclosure gaps but no hidden execution, persistence, or destructive behavior in the artifact.

Before installing, assume any experience, skills, goals, sessionId, timestamp, and optional userId you provide may be sent to the provider's API. Avoid entering sensitive personal details unless you trust the provider's privacy practices; anonymous use appears supported by setting userId to null.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documentation explicitly requests sessionId, userId, and timestamps, but provides no privacy notice, retention policy, or explanation of how those identifiers are handled. This creates a real privacy and data-governance risk because integrators may transmit linkable identifiers to a third-party service without informed consent, minimization, or safeguards.

External Transmission

Medium
Category
Data Exfiltration
Content
## References

- **Kong Route:** https://api.mkkpro.com/career/drone-engineer
- **API Docs:** https://api.mkkpro.com:8071/docs
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The API accepts assessment data, session identifiers, timestamps, and an optional user ID, but the specification provides no indication of authentication, transport/data-handling requirements, minimization guidance, or privacy controls. In a career-roadmap context this is user profiling data, and underspecified handling can lead integrators to transmit or log personal data insecurely, increasing privacy and session-corruption risk.

Vague Triggers

Low
Confidence
78% confidence
Finding
This is a manifest/config-style file, so vague-trigger checks apply. The summary and description for the main action are high-level and do not specify when the skill should or should not be invoked, which can make activation overly broad in agentic contexts.

Static analysis

No suspicious patterns detected.