ClawHub
Back to skill

Security audit

daily-standup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward standup assistant that collects team updates, posts a summary, and keeps an archive, with privacy and retention considerations users should configure deliberately.

Before installing, make sure participants know where updates may be collected from, who will see summaries, and what gets archived. Use a dedicated standup channel, restrict gateway permissions, and set team rules for redacting private or sensitive information before it is posted or stored.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill describes collecting updates from team members through DMs or channels and redistributing them, but it does not warn users that potentially sensitive work status, blockers, or personal context may be shared more broadly than intended. In a workplace setting, this can lead to inadvertent disclosure of internal project details or private employee information to a team channel or other participants.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that standup content is saved to local memory files and that notable blockers or decisions are copied into MEMORY.md, but it does not warn users that their updates will be retained beyond the immediate standup. This creates a data retention and privacy risk because sensitive operational details may be stored persistently and later accessed, searched, or reused without participants' awareness.

Static analysis

No suspicious patterns detected.