ClawHub
Back to skill

Security audit

Envcheck

Security checks for vulnerabilities and agentic risk

Overview

This is a small local readiness checker that reports whether named environment variables and command-line tools exist, without reading secret values or making unrelated changes.

Install only if you want a local pre-flight environment checker. Keep the uvicorn service bound to localhost or otherwise protected, because callers can learn whether specific environment variable names and binaries exist even though secret values are not disclosed.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill inspects environment variables and CLI availability, which is a form of environment access, but it declares no corresponding permissions or trust boundary information. That mismatch can mislead users and higher-level tooling about what the skill observes, increasing the risk of unreviewed disclosure of local system state.

Static analysis

No suspicious patterns detected.