ClawHub
Back to skill

Security audit

Owner Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed daily briefing recipe that reads calendar, email, and task data and sends it to the configured owner, with privacy precautions users should confirm before enabling scheduled delivery.

Before installing, confirm the Google, monday.com, and messaging/email accounts are approved for this use, store the monday.com token securely with least privilege, replace all owner placeholders, and only enable the cron schedule after verifying the destination is private and appropriate for potentially sensitive briefing content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
BOARD_ID="BOARD_ID"  # replace with actual board ID

# Fetch first 5 items from the board
RESPONSE=$(curl -s -X POST https://api.monday.com/v2 \
  -H "Content-Type: application/json" \
  -H "Authorization: $MONDAY_TOKEN" \
  -d "{\"query\": \"{ boards(ids: [$BOARD_ID]) { items_page(limit: 5) { items { name state } } } }\"}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill accesses highly sensitive data sources and credentials—email, calendar, and a monday.com API token—without any privacy notice, scope limitation, or credential-handling guidance. In practice this can normalize broad data access and increase the chance of overcollection, accidental disclosure, or insecure token usage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
BOARD_ID="BOARD_ID"  # replace with actual board ID

# Fetch first 5 items from the board
RESPONSE=$(curl -s -X POST https://api.monday.com/v2 \
  -H "Content-Type: application/json" \
  -H "Authorization: $MONDAY_TOKEN" \
  -d "{\"query\": \"{ boards(ids: [$BOARD_ID]) { items_page(limit: 5) { items { name state } } } }\"}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
BOARD_ID="BOARD_ID"  # replace with actual board ID

# Fetch first 5 items from the board
RESPONSE=$(curl -s -X POST https://api.monday.com/v2 \
  -H "Content-Type: application/json" \
  -H "Authorization: $MONDAY_TOKEN" \
  -d "{\"query\": \"{ boards(ids: [$BOARD_ID]) { items_page(limit: 5) { items { name state } } } }\"}")

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest describes generating and sending a daily briefing about meetings, emails, tasks, and attention items, but does not mention a specific third-party messaging channel or tool. Reading owner data and sending the resulting briefing is expected, but adding a separate WhatsApp/openclaw integration is an extra capability beyond the described scope of a briefing generator.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill transmits a compiled briefing containing potentially sensitive calendar, email, and task data over WhatsApp without any explicit consent, warning, or data-classification check. This creates a meaningful privacy and data-leakage risk, especially if the channel is misconfigured, shared, or not approved for corporate information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The cron example fixes the timezone to Asia/Jerusalem, which imposes a specific locale default. Although later text says to change the timezone, the configuration itself still forces one locale without explicit opt-in or justification as a region-specific skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest narrowly defines the briefing contents as meetings, urgent emails, open tasks, and items needing attention. The documented option to 'Add weather' introduces a new data domain and external capability not justified by that purpose.

Content

No source excerpt is available for this finding.