ClawHub
Back to skill

Security audit

Sharebench

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Sharebench registry-search helper with disclosed network lookup behavior and no executable install or persistence mechanism.

Before installing, understand that searches are sent to Sharebench. Use generalized queries and avoid secrets, private customer data, internal project names, regulated information, or other confidential details. Read any returned artifact fully before reusing it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill explicitly instructs users to send arbitrary search queries to a third-party public endpoint, but it does not warn that prompts or search terms may contain sensitive user, customer, or internal project information. In an agent setting, this can cause unintended data disclosure because seemingly harmless discovery queries may include proprietary requirements, identifiers, or regulated data.

Static analysis

No suspicious patterns detected.