ClawHub
Back to skill

Security audit

Blackboard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local coordination helper that persistently records task handoffs in JSON files, with its filesystem behavior disclosed and aligned with that purpose.

Install only if you want agents to persist shared task state in local JSON board files. Keep boards in an intended project/work area, review the contents before routing work between agents, and make sure any integration treats user/* decisions as authenticated user input rather than model-selected strings.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs use of a helper script that reads and writes board files, performs validation, and invokes shell commands, yet no permissions are declared. This creates a capability-transparency problem: callers and policy systems may underestimate the skill's ability to access the environment and filesystem or trigger command execution, increasing the chance of unsafe deployment or misuse.

Static analysis

No suspicious patterns detected.