ClawHub
Back to skill

Security audit

Dispute Resolver

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only dispute-response writing skill with purpose-aligned handling of buyer evidence, but users should apply privacy and platform-policy controls when using buyer history or block-list recommendations.

Before installing or using this skill, treat buyer records, chat logs, tracking data, photos, payment evidence, and dispute history as sensitive. Collect only what is needed for the specific case, keep logs access-controlled and time-limited, verify current marketplace and payment-processor policies, and avoid permanent or automated buyer blocking without objective evidence and human review.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly tells users to capture buyer dispute history and other buyer-linked records without any privacy, minimization, retention, or access-control guidance. In a dispute workflow, this increases the chance that operators will accumulate unnecessary personal data or use it outside allowed platform or legal purposes, creating privacy and compliance risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Recommending a buyer block-list entry based on dispute patterns, without warnings about verification, appeals, discrimination/fairness concerns, or platform-policy limits, can lead to unjustified customer restriction and improper profiling. In this context, the skill operationalizes adverse decisions about buyers using dispute history, making the omission more dangerous than a generic note-taking recommendation.

Static analysis

No suspicious patterns detected.