ClawHub
Back to skill

Security audit

Executive

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only executive assistant skill is purpose-aligned, but users should deliberately limit which inbox, calendar, task, and news sources it can access.

Install only if you want an assistant to prepare proactive executive briefings from connected work data. Before enabling it, limit access to intended email, calendar, task, metric, and news sources, and keep message sending or external sharing behind explicit approval.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill defines activation around a recurring 'heartbeat cycle' and broad checks like scanning unread messages, meetings, tasks, and external intelligence, but it does not clearly constrain what system event, user consent, scope, or data sources govern those actions. In an executive context with access to sensitive communications and schedules, this ambiguity can cause over-broad autonomous behavior, unnecessary data access, or repeated triggering at inappropriate times.

Static analysis

No suspicious patterns detected.