ClawHub
Back to skill

Security audit

Cloud Architect

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly harmful, but it grants local command execution while describing itself mostly as advisory and does not clearly limit command or callback use.

Review before installing. Use this skill only in trusted workspaces, keep cloud credentials and production accounts out of reach unless you explicitly intend to authorize access, and treat any suggested command or IaC change as requiring human review. Avoid providing a callback URL unless you trust the destination and are comfortable with task results or metadata being sent there.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest exposes the exec tool even though the skill is described as architecture guidance/documentation-oriented. This increases the privilege available to the skill and creates a mismatch between user expectations and actual capability, enabling command execution paths that could be abused for local actions or data access if the agent follows unsafe prompts.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation states the skill does not directly access user cloud accounts and frames itself as non-executable guidance, but the manifest still grants exec capability. This contradiction can mislead users and reviewers about the skill's effective privileges, increasing the chance that sensitive commands are run under false assumptions of safety.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill accepts a callback_url for asynchronous completion notices without warning users about outbound data transmission, privacy implications, or trust requirements for the destination. In agent contexts, callback mechanisms can exfiltrate task data, results, or metadata to attacker-controlled endpoints if not tightly controlled and disclosed.

Static analysis

No suspicious patterns detected.