ClawHub
Back to skill

Security audit

Headers

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward website security-header checker that contacts user-specified sites and reports missing headers.

Install if you want a simple HTTP security-header audit helper. Run it only against sites you own or are authorized to check, and remember that each target site will receive a request from your environment.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises network behavior ('checks one or more sites', auto-adds https://, audits website headers) but the manifest does not declare any corresponding permission. Undeclared network capability creates a transparency and policy gap: users and hosting platforms cannot accurately assess or constrain outbound requests, which can lead to unexpected external connections or misuse if the implementation changes.

Static analysis

No suspicious patterns detected.