ClawHub
Back to skill

Security audit

Homeclaw

Security checks for vulnerabilities and agentic risk

Overview

This simple markdown skill should be reviewed because it asks an AI to handle health alerts, emergency calls, smart-home control, and pet feeding without clear safeguards.

Install only if you are comfortable reviewing and constraining it yourself. Before use, require explicit consent from household members, set manual confirmation for emergency calls and physical device changes, avoid treating alerts as medical advice, and define retention and access rules for health, child, pet, and home-security data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill describes monitoring elderly health data, medication reminders, and emergency alerting, but it does not clearly warn users about the sensitivity of health data, possible misclassification of alerts, or the risks of relying on the system for medical decision-making. In a family setting involving older adults and children, omission of these warnings can lead to unsafe overreliance and underestimation of privacy exposure.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises control over smart home devices and pet-feeding systems without warning that incorrect automation, misconfiguration, or unauthorized use can affect the physical environment and animal welfare. Because these actions can change locks, appliances, feeding schedules, or household conditions, users need clear warnings and operational safeguards.

Static analysis

No suspicious patterns detected.