ClawHub
Back to skill

Security audit

Email Header Analyser

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: analyze user-provided email headers through an external API, with a privacy disclosure gap but no hidden or unrelated behavior found.

Install only if you are comfortable sending email header contents to the listed external analysis service. Redact unnecessary personal, internal routing, or regulated data where possible, and avoid submitting real incident or production headers unless you have authorization and acceptable data-handling terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This skill explicitly sends raw email headers to an external API for analysis, but the description does not warn users that headers often contain sensitive metadata such as internal IPs, hostnames, email addresses, routing paths, and authentication details. In a security/forensics context, users are especially likely to submit real incident data, so omission of a disclosure materially increases the risk of unintended sensitive-data exfiltration to a third party.

Static analysis

No suspicious patterns detected.