ClawHub
Back to skill

Security audit

PB Module Triage

Security checks for vulnerabilities and agentic risk

Overview

This skill reads local autonomous-driving protobuf logs and optionally writes a report, which fits its stated diagnostic purpose.

Install this only for repositories where you are comfortable letting the agent inspect autonomous-driving PB logs and derived module evidence. Prefer supplying the exact PB file or directory and output path, since logs may include location, sensor, or operational data.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read project files, inspect the repository for candidate .pb recordings, and optionally write machine-readable output such as report.json, but it does not declare permissions for those capabilities. This creates a trust and policy gap: an operator may approve or invoke the skill assuming it is non-invasive, while it can actually access local data and create artifacts, increasing the risk of unintended data exposure or writes in sensitive repositories.

Static analysis

No suspicious patterns detected.