ClawHub
Back to skill

Security audit

Afrexai Business Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a business automation template, but it asks for command execution and gives under-scoped examples for recurring agents, API calls, and financial workflow actions.

Install only if you want an exec-enabled automation design skill. Before using it on real business systems, narrow invocation triggers, require explicit approval for shell commands, outbound API calls, recurring jobs, payments, account changes, and public posting, and test with dry-run or sandbox data first.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The metadata claims risky code and external dependency references were removed, but the skill explicitly enables exec, shell scripting, curl-based API access, and environment-based credentials elsewhere in the file. This mismatch can mislead users and reviewers into granting the skill more trust than warranted, increasing the chance that dangerous capabilities are enabled without proper scrutiny.

Vague Triggers

High
Confidence
90% confidence
Finding
The trigger keywords are extremely broad and overlap with common business language such as 'turn', 'architect', 'automation', 'business', and 'agent'. In a platform that auto-invokes skills based on keywords, this can cause unintended activation of a high-privilege skill that has exec access, exposing users to command execution and workflow actions they did not explicitly request.

External Transmission

Medium
Category
Data Exfiltration
Content
log "Fetching data from [source]..."
DATA=$(curl -s -H "Authorization: Bearer $API_TOKEN" \
  "https://api.example.com/endpoint")

if [ -z "$DATA" ]; then
  log "ERROR: No data returned"
Confidence
92% confidence
Finding
The skill includes a concrete curl pattern for sending authenticated requests to an external API endpoint using a bearer token from the environment. In the context of a skill with exec permissions, this normalizes network exfiltration and external data transmission, and could be adapted to send sensitive business data or secrets to third-party endpoints.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
→ Extract data (vendor, amount, line items, due date)
  → Match to PO / budget category
  → Validate:
    - Amount within approved range? → Auto-approve
    - Over threshold? → Route to manager
    - No matching PO? → Flag for review
  → Schedule payment based on terms
Confidence
84% confidence
Finding
The workflow pattern explicitly endorses automatic approval of invoices within a threshold, which is an autonomous financial decision. In a business automation skill, this is contextually plausible, but it is still risky because misconfiguration, poisoned inputs, or invoice fraud could cause unauthorized payments without human review.

Static analysis

No suspicious patterns detected.