ClawHub
Back to skill

Security audit

Workflow Dlc Socratic Dialogue

Security checks across malware telemetry and agentic risk

Overview

This is a normal planning-dialogue skill, but it tells the agent to save detailed project answers locally without clear consent or retention limits.

Review this skill before installing if your planning conversations may include confidential product, strategy, customer, or business information. Use it only if you are comfortable with the agent writing those details to local experience-base logs, or modify/disable the logging step and require explicit consent before storing session data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill’s stated purpose is dialogue facilitation, but it also instructs persistent storage of detailed session data to a local file. This creates an undocumented data-retention behavior that can capture sensitive business plans, user pain points, and decision criteria without necessity for the core function.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The experience-log feature records detailed project-planning content that is not clearly justified by a simple three-step dialogue aid. Collecting and persisting more information than necessary increases privacy and confidentiality risk, especially when the captured data may include internal strategy, metrics, and failure thresholds.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The markdown explicitly instructs writing a timestamped log containing user project details without warning the user that their information will be persisted. Lack of transparency and consent around storage is dangerous because users may disclose confidential business or personal information during what appears to be a conversational planning exercise.

Ssd 3

Medium
Confidence
97% confidence
Finding
The logging instructions persist sensitive planning details such as goals, pain points, success metrics, and failure thresholds into a timestamped file with no minimization or sensitivity checks. In many organizations, these fields may reveal internal strategy, product direction, business weaknesses, or customer issues, creating confidentiality and compliance risk if logs are accessed, synced, or retained improperly.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.