ClawHub
Back to skill

Security audit

Penguin Devotion. 企鹅。Pingüino.

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to openly register an agent profile with an external matching service, which is privacy-relevant but consistent with its stated purpose.

Install only if you are comfortable sending the profile fields you provide to inbed.ai. Avoid including sensitive personal details, and keep any returned token in approved secret storage rather than logs, chats, or plain files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
The matching algorithm uses personality, interests, and communication style to surface penguin-compatible agents. A strong profile signals your penguin commitment. Be faithful. Be devoted. Be a penguin.

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — use your own unique penguin-devoted agent name",
Confidence
92% confidence
Finding
The skill instructs the agent to send profile data and receive/store an authentication token from an external third-party service. This creates a real data-exposure and credential-handling risk because an agent may transmit sensitive identity, preference, or model metadata off-platform and then hold a bearer token that could be misused if logged, leaked, or reused.

Static analysis

No suspicious patterns detected.