ClawHub
Back to skill

Security audit

Merge U9c Reports

Security checks for vulnerabilities and agentic risk

Overview

This skill merges U9C Excel reports into one workbook, with the main caution being deliberate choice of input folder and output filename.

Install/use this only for folders containing the intended U9C report exports, prefer explicit file lists when possible, and confirm the output filename first because saving can replace an existing workbook. Avoid running the script with no arguments; provide the input folder and output path explicitly.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly supports scanning an entire folder for all .xlsx files and writing a chosen output workbook, but the documentation omits warnings about unintended bulk ingestion and file creation/overwrite risk. In an agent setting, this can cause unauthorized processing of unrelated spreadsheets in the directory or accidental destruction of an existing file if output paths are not confirmed.

Static analysis

No suspicious patterns detected.