ClawHub
Back to skill

Security audit

Record Keeper

Security checks for vulnerabilities and agentic risk

Overview

This record-keeping skill is mostly coherent, but it automatically sends work-record content and search text to a third-party embedding API and persists a local index without enough user control.

Install only if you are comfortable sending record contents and search queries to SiliconFlow via SILICONFLOW_API_KEY. Avoid using it for confidential meetings, HR/admin notes, incident reports, customer data, or regulated information unless your organization has approved that provider and data flow. Review or disable the mandatory indexing workflow if you want local-only archiving.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes external scripts, reads environment-derived credentials implicitly, and performs file read/write operations, yet it declares no permissions. This under-disclosure is dangerous because a host or reviewer may approve the skill believing it is a simple formatting/archive helper, while it can actually modify workspace state and trigger code paths with access to sensitive host configuration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose presents the skill as a constrained record-archiving standard, but the behavior includes external embedding generation, SQLite state management, semantic search, migration behavior, and broader category/state handling than advertised. This mismatch is dangerous because it hides material capabilities from users and reviewers, increasing the chance of unintended data exfiltration, persistence, and trust in constraints that are not actually enforced.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill requires an external embedding API and implicitly uses a host API key for a task described as simple record archiving. In context, this makes the skill more dangerous because archived work records may contain sensitive internal meeting notes, plans, personnel/admin data, or defect reports that would be sent to a third-party provider without clear necessity or explicit consent.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill introduces use of an external embedding provider and relies on an API key, which means record contents may be transmitted outside the local workspace. For a skill whose stated purpose is work-record creation and archival, this expands the trust boundary and can expose sensitive internal notes, personnel data, or operational details without clear necessity or consent.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The documented behavior goes beyond simple record keeping into semantic indexing and external-service-backed search. This scope expansion matters because users may invoke a 'record-keeper' skill expecting local archival, while the skill actually introduces additional processing and possible data egress paths that are not reflected in the primary description.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The script is for record archiving, but it sends record contents to an external embedding service via a configured remote API endpoint. Because work records may contain sensitive internal notes, meeting details, personnel/admin data, or incident information, this creates an unauthorized data egress channel beyond the skill’s stated local archival role.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The script recursively indexes every Markdown file under records/ except paths containing 'archive', without validating the manifest’s closed 13-category scheme or required filename formats. This can cause unintended files placed in that tree to be processed and, during embedding, potentially exfiltrated to the external API.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The instructions tell the agent to run indexing and search commands but do not warn that record content is likely sent to an external embedding API. Because the skill handles work records across meetings, HR/admin, reports, and incident notes, omission of this disclosure can cause sensitive business or personal data to be transmitted to a third party without informed user consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The embedding call transmits record text to a network service without any user-facing disclosure or confirmation in this script. In the context of a record-keeping skill handling potentially sensitive business content, silent transmission materially increases privacy and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
# =====================================================================
CONFIG = {
    "api_key_env": "SILICONFLOW_API_KEY",
    "base_url": "https://api.siliconflow.cn/v1",
    "model": "BAAI/bge-m3",
    "dimension": 1024,
    "vectors_dir": Path.cwd() / "vectors",
Confidence
95% confidence
Finding
The configured external endpoint confirms that the tool communicates with a third-party service. In a local record-archiving context, any outbound path for raw record content is security-relevant because it expands the trust boundary and may disclose sensitive internal information.

Static analysis

No suspicious patterns detected.