ClawHub
Back to skill

Security audit

Recallit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent study-tool integration that installs and uses the recallit CLI to create and review flashcard packs.

Install only if you are comfortable adding the recallit CLI and bun to the environment. Treat web-grounded or third-party packs from GitHub, git, npm, or tarballs like any other untrusted content: review the source and install only packs you asked for.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The concept-pack mode authorizes open-ended web search and fetch based only on a concept name, expanding the skill from local flashcard authoring into autonomous browsing and content acquisition. That increases the attack surface for prompt-injection from fetched pages, accidental retrieval of sensitive or irrelevant content, and actions outside the user’s likely expectation for a study tool.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Allowing `recallit topic add` from GitHub, arbitrary git URLs, npm specs, or tarballs broadens the skill into remote package/content installation from untrusted sources. This creates a clear supply-chain risk and can lead the agent to fetch and install attacker-controlled artifacts under the guise of importing a study pack.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **Conversational (default).** Scope briefly, preview ~3 sample cards, let the user steer, confirm, install.
- **Ambient.** The user described intent in prose ("turn this into a deck of just the actionable stuff"). Parse source + filter from their words, echo back what you understood, then proceed as conversational.
- **One-shot.** The user said "just do it" / "no preview". Skip the preview; generate, gate, install ready cards, report. Still never auto-install needs-review or web-grounded cards without asking.

### Step 1 — ingest the source into `.author/source.txt`
Confidence
78% confidence
Finding
The one-shot mode permits generating, gating, and installing cards based on inferred user intent, which authorizes consequential actions without a fresh confirmation step. In context, this is more dangerous because the skill can ingest sources, write files, and install topics, so silent execution may surprise the user and normalize autonomous state-changing behavior.

Static analysis

No suspicious patterns detected.