ClawHub
Back to skill

Security audit

brand-knowledge

Security checks for vulnerabilities and agentic risk

Overview

This brand manager is mostly coherent, but its script can write outside the intended brand-data folder if a brand name contains path characters.

Review before installing. The skill is not showing hidden exfiltration or destructive intent, but it should validate brand names so profile creation and switching cannot address files outside the intended brand store. Use only trusted brand names and avoid path-like names until that is fixed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description and trigger scope are broad enough that an agent could invoke it for loosely related 'brand' tasks without a clear user confirmation boundary. Because the workflow includes persistent writes and active-brand switching, over-broad invocation increases the chance of unintended state changes or file modifications from ambiguous prompts.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill performs persistent writes to `data/brands/*.json` and updates shared state via `active_brand.json`, but the user-facing description does not clearly warn that these operations modify durable local state. This is dangerous because users may believe they are performing a temporary lookup or analysis when they are actually creating records or changing the default brand context for future tasks.

Static analysis

No suspicious patterns detected.