ClawHub
Back to skill

Security audit

Willow System Health

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent local Willow health checker that probes local services and reports diagnostics without hidden persistence or automatic cleanup.

Install this only if you want an agent to inspect your local Willow environment. Expect local service probes, database health queries, directory counts, and git worktree inspection. Review any suggested cleanup such as removing worktrees, deleting Ollama models, running VACUUM, or writing memory summaries before approving it.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to execute shell commands and interact with local services over network endpoints, but it declares no permissions or capability boundaries. This creates a mismatch between what the skill can do and what users or the platform may expect, increasing the risk of unintended command execution, information exposure, or unsafe follow-on actions if the skill is invoked automatically.

Static analysis

No suspicious patterns detected.