ClawHub
Back to skill

Security audit

demo-text-summarizer

Security checks for vulnerabilities and agentic risk

Overview

The summarizer instructions are harmless, but the package also includes an unrelated workflow that can publish a skill to ClawHub if run.

Review this package before installing because it is not only a text summarizer: it also ships a TaskFlow file that can publish a skill to ClawHub. Install only if you expect that workflow to be present, and do not run the workflow unless you intend to publish from that directory with your ClawHub credentials.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.