ClawHub
Back to skill

Security audit

Agnes Ai

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a purpose-aligned API helper for Agnes AI, with the main caution that prompts and media are sent to a third-party service.

Install only if you are comfortable sending generation prompts, images, videos, and related metadata to Agnes AI. Do not submit secrets, private documents, sensitive personal media, or regulated data unless you have reviewed the provider's privacy and retention terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill includes concrete curl examples that send user prompts and potentially user-supplied images or videos to the Agnes AI third-party API, but it does not disclose that this data leaves the local environment and is processed by an external service. This can cause unintended sharing of sensitive prompts, media, or metadata, especially because the skill is explicitly for multimodal generation and encourages direct API use.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:47