ClawHub
Back to skill

Security audit

A.I Ventures Test Gen A.I Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is disclosed and purpose-aligned, but appears incomplete because its required analysis script is empty.

Only install this if you understand it may not work until analyze-dom.js is implemented. If a future version adds the DOM analyzer, review that code and only run it on URLs you are comfortable opening through local browser automation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to execute `node analyze-dom.js <URL>` directly on a user-supplied URL, which causes external network access and local command execution behavior without any warning, validation, or restriction. In an agent environment, this can be abused to trigger requests to internal services, sensitive endpoints, or attacker-controlled infrastructure, and the skill gives no safeguards around allowed schemes, hosts, or execution boundaries.

Static analysis

No suspicious patterns detected.