ClawHub
Back to skill

Security audit

Wedding.skill

Security checks for vulnerabilities and agentic risk

Overview

This is a local wedding-planning skill with disclosed memory; users should be careful because it can store private budget, vendor, guest, and family details.

Install only if you are comfortable with wedding planning information being saved locally under ~/.wedding-skill/. Avoid entering payment credentials or unnecessary sensitive guest details, review any drafted vendor messages before sending, and delete that folder when you no longer want the planning history retained.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The Budget Mode trigger is defined as 'Any money-related question,' which is overly broad and can activate on ordinary conversation that merely mentions costs, prices, or finances. In a skill that persists user data across sessions, this increases the chance of unintended invocation, inappropriate context carryover, and collection or display of sensitive wedding budget information when the user did not explicitly intend to use this skill.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The Vendor Mode trigger is described only as 'Vendor question or deadline approaching,' which is ambiguous and leaves activation boundaries unclear. Because the skill stores detailed vendor contacts, contract terms, and notes, loose triggering can cause accidental retrieval or drafting actions based on unrelated discussion, exposing sensitive planning data or causing the agent to act on stale assumptions.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The Day-Of Mode trigger activates based on a vague time condition ('Wedding week') rather than explicit user intent or strict rules. Time-based auto-activation around a stressful event can cause the system to surface timelines, emergency contacts, or vendor details unexpectedly, especially given the skill's persistent local memory and sensitive personal-event data.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The Couple Mode trigger uses 'Disagreement or decision needed,' which requires the system to infer relationship conflict from vague conversational signals. In this skill's context, that can lead to over-collection or inappropriate resurfacing of sensitive interpersonal preferences, family dynamics, and unresolved disputes, increasing privacy and safety risks if the mode activates incorrectly.

Static analysis

No suspicious patterns detected.