ClawHub
Back to skill

Security audit

Restaurant Business Analyst

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent restaurant business analysis skill whose online search and local report output are disclosed and fit its purpose.

Install if you are comfortable with the agent searching the web for the restaurant brands or queries you provide, then saving and opening a generated HTML report in Downloads. Avoid confidential competitive research terms unless you control the search and output environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README explicitly advertises network-based news searching but does not warn users that prompts or derived queries may be sent to external services. In an agent skill context, this can expose sensitive brand names, internal research topics, or user-provided business data to third parties without informed consent, making it a real privacy and data-handling issue.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to write an HTML file into the user's Downloads folder and automatically open it, but it does not require explicit user consent for local file creation or launching local content. Auto-opening generated HTML can create privacy, trust, and content-safety risks, especially if searched web content or user-supplied brand text is embedded without strict sanitization.

Static analysis

No suspicious patterns detected.