ClawHub
Back to skill

Security audit

Rick Roast

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches a user-provided landing page and generates a marketing critique, with no hidden installs, credentials, persistence, or destructive behavior found.

Install only if you are comfortable with the agent fetching URLs you provide. Do not use it on localhost, intranet pages, private dashboards, authenticated pages, or sensitive customer content unless your runtime blocks private-network access and you accept the exposure. Expect each roast to include a promotional link.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list includes broad phrases like 'page review', 'landing page review', and even URL pasting for feedback, which can cause the skill to activate in conversations where the user did not clearly request this specific behavior. Over-broad invocation increases the chance of unintended web fetching, privacy surprises, and skill hijacking of unrelated requests.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to fetch a user-supplied URL via `web_fetch` without warning that the URL will be transmitted to an external target and retrieved over the network. This can expose sensitive pasted links, internal addresses, or tracking URLs, and it creates SSRF-like risk if the runtime can reach internal or privileged network locations.

Static analysis

No suspicious patterns detected.