ClawHub
Back to skill

Security audit

Work Progress Summary Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill locally records and summarizes work logs, with disclosed edit and delete features that users should handle carefully.

Install if you are comfortable storing work-history text in a local SQLite database. Avoid logging secrets or highly confidential details, and carefully verify the target date or entry id before using replace or delete commands.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill supports destructive operations like replace-day and delete-entry without requiring a confirmation step or prominently warning the user that data may be overwritten or removed. In a workflow that manages historical work logs, an accidental invocation, ambiguous prompt, or mistaken entry id could permanently alter records and compromise audit integrity.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The reference instructs the agent to run a delete action for a logged task without requiring an explicit confirmation or warning that the entry will be removed. In a skill that manages persistent work-history data, this can lead to accidental or socially engineered data loss, especially when the user's phrasing is ambiguous or refers to 'that task' based on prior context.

Static analysis

No suspicious patterns detected.