ClawHub
Back to skill

Security audit

markdown-indexer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Markdown indexing helper, with one privacy caveat around its optional upload example.

Install only if you are comfortable running local indexing commands on the folders you choose. Review index.json before sharing or uploading it, because document paths, titles, line counts, and related metadata may expose private project or note details.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The example workflow explicitly posts the generated index to a remote API, but the skill provides no warning that file paths, titles, and other extracted metadata may contain sensitive internal information. In a document-indexing context, users may reasonably run this against private notes or internal docs, making unannounced data transmission a real privacy and confidentiality risk.

Static analysis

No suspicious patterns detected.