ClawHub
Back to skill

Security audit

Tender Generator Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a local tender document generator with expected file reads/writes and no evidence of hidden networking, persistence, or destructive behavior.

Before installing, understand that the skill may process sensitive tender, pricing, company, and bank-account fields locally and write generated documents to disk. Use trusted source documents/templates and manually review all bid documents before submission.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises shell, file read, and file write capabilities via its documented usage, but declares no permissions or execution constraints in metadata. This creates a mismatch between apparent capabilities and governance, increasing the risk of unauthorized filesystem access, document exfiltration, or unsafe command execution if the runtime grants these abilities implicitly.

Static analysis

No suspicious patterns detected.