ClawHub
Back to skill

Security audit

BMS CAN Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a local CAN log analysis helper with only minor setup cautions around dependency installation.

Install dependencies only from trusted sources, preferably in an isolated Python virtual environment. Use explicit output paths because the scripts can write local result files or plots when requested.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This markdown file states that the skill will automatically install dependencies if they are not present, which can change the user's system environment. The description does not include any caution, confirmation expectation, or note that package installation may write to the environment and affect system integrity.

Static analysis

No suspicious patterns detected.