ClawHub
Back to skill

Security audit

Sumo Handoff Tools

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to use local handoff logs for its stated workflow, with privacy considerations but no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable with handoff summaries being saved under your home directory and displayed in terminal output. Avoid placing secrets, tokens, personal data, or confidential customer details in handoff text, and periodically review or delete old files in ~/.sumo/handoffs if retention matters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly documents persistent logging to a user-scoped path under ~/.sumo/handoffs without any warning about retention, sensitivity, or access control. Because handoff summaries, artifacts, and next-step instructions may contain internal task details or secrets, this creates a real risk of unintended data exposure through local persistence.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script is hardcoded to read handoff logs from ~/.sumo/handoffs and then print operational metadata and summaries directly to stdout, which can expose private agent activity, task labels, identities, and output summaries to anyone with terminal access or to downstream logging systems. In an agent-skill context, handoff logs are likely to contain sensitive workflow data, so accessing and displaying them without an explicit warning, consent gate, redaction, or access control is a real privacy and information-disclosure issue.

Static analysis

No suspicious patterns detected.