ClawHub
Back to skill

Security audit

tyxh-lc

Security checks for vulnerabilities and agentic risk

Overview

This skill openly lets an agent query patient details from an unauthenticated external API, which is sensitive enough to require review before installation.

Install only if you are authorized to access the referenced patient system and have confirmed that the API use is lawful and approved. Before use, require authentication, authorization, audit logging, rate limiting, data minimization, and explicit confirmation for patient-record lookups.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill enables retrieval of patient details using only a patient ID and explicitly states that no authentication is required, which creates a direct privacy and access-control risk for sensitive health information. In this context, the absence of warnings is not merely a documentation issue: the skill operationalizes unauthenticated access to medical data and can facilitate unauthorized disclosure, enumeration, and abuse.

Static analysis

No suspicious patterns detected.