ClawHub
Back to skill

Security audit

Asb

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward ASB MCP integration, with no evidence in the artifact of hidden data access, exfiltration, or destructive behavior.

Before installing, review and trust the upstream Agent-Service-Bus package because the skill delegates runtime behavior to external Python code. Treat LLM calls and message sending as potentially outbound, and avoid sending sensitive data until you understand the configured providers and destinations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly advertises `llm-provider` and `message-send` capabilities, which imply data may be transmitted to external models or messaging endpoints, but it does not warn users about possible outbound communication, data sharing, or privacy implications. In an agent/MCP context, this omission is security-relevant because users may provide sensitive prompts or documents without realizing they could leave the local environment.

Static analysis

No suspicious patterns detected.