ClawHub
Back to skill

Security audit

多智能体联合研究框架

Security checks for vulnerabilities and agentic risk

Overview

The skill discloses cloud synchronization of research results, which fits its workflow but requires care with sensitive material.

Before installing, confirm which cloud storage location is used, what files or notes are uploaded, and whether you can disable sync or keep sensitive research local.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly states that results are automatically synchronized to a specified cloud storage location, but it does not mention user consent, data classification, destination validation, or privacy/security controls. In a multi-agent research workflow, outputs may include sensitive research data, intermediate notes, citations, or proprietary project material, so silent or default external transmission creates a real data exfiltration and compliance risk.

Static analysis

No suspicious patterns detected.