ClawHub
Back to skill

Security audit

Interviewly

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward mock-interview API skill, but users should treat interview answers and reports as sensitive data sent to a remote service.

Install only if you are comfortable sending interview content to Interviewly/toolweb and Claude for evaluation. Avoid submitting secrets, confidential employer information, or highly sensitive personal details, and protect session IDs and report URLs because the artifacts do not explain retention, deletion, authentication, or link expiration.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly describes sending sensitive candidate data, including user identifiers and free-form interview responses, to a third-party remote API but provides no privacy notice, retention details, consent guidance, or data-handling constraints. Because interview responses can contain personal, employment, or confidential information, this omission creates a real privacy and compliance risk rather than a purely informational issue.

External Transmission

Medium
Category
Data Exfiltration
Content
{
  "success": true,
  "overall_score": 78,
  "report_url": "https://api.toolweb.in/api/v1/download/sess_a1b2c3d4e5f6",
  "message": "Interview completed. Report generated successfully."
}
```
Confidence
88% confidence
Finding
The documented workflow returns a report download URL on an external domain, confirming that interview artifacts are stored or served remotely. In context this is expected API behavior, but it still represents a genuine external data transmission and exposure surface because reports may contain sensitive assessment content and session identifiers, and no access-control or expiration guarantees are documented.

Static analysis

No suspicious patterns detected.