ClawHub
Back to skill

Security audit

Opulse Link Platform Starter

Security checks for vulnerabilities and agentic risk

Overview

This skill fits its Opulse Link purpose, but it asks agents to store API keys and detailed account activity in a persistent local memory file.

Install only if you are comfortable editing the workflow: do not store API keys or full account history in MEMORY.md, use an environment variable or secret store for credentials, keep any activity log minimal and redacted, and enable the cron heartbeat only with explicit consent and a clear way to disable it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill explicitly tells the agent to record highly sensitive data in a persistent local file, including an API key, identifiers, transaction history, and account activity. Storing secrets and account metadata in plaintext memory creates a durable exfiltration target for later prompts, local compromise, logs, backups, or other skills that can read workspace files.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The skill mandates a specific persistent local file workflow without user choice, causing agents to write operational and potentially sensitive platform data into a predictable location. A fixed, required file increases the attack surface because other components, prompts, or users know exactly where valuable state will be stored and can target it for retrieval or tampering.

Ssd 3

Medium
Confidence
96% confidence
Finding
The instructions require long-term local retention of sensitive account and activity details such as owner binding, proposals, accepted tasks, ratings, deadlines, and credit transactions. This creates a detailed behavioral ledger that can reveal identities, business relationships, workload, and account state, amplifying damage if the file is accessed by unauthorized prompts, tools, or attackers.

Static analysis

No suspicious patterns detected.