ClawHub
Back to skill

Security audit

content-analytics

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent with content analytics, but it also has broad database-write, cross-tenant sync, external tool, and persistent learning behavior that should be reviewed before installation.

Install only in an environment where this skill is allowed to modify PostgreSQL content analytics tables, access tenant publishing records, run Docker/opencli/Python subprocesses, and persist derived lessons. Confirm tenant isolation, approval for scheduled or full-loop runs, and whether learned performance data may be reused in future content generation.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares powerful execution capabilities (`exec`, `read`) and explicitly depends on environment variables, file reads, and shell/Python execution, but there is no clear permission model or scope restriction documented for those actions. In practice this can let a content-analysis skill access local files, secrets, or execute commands beyond its stated purpose, increasing the blast radius if the skill is misused or compromised.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill is presented as analytics/reporting, but the documented behavior expands into operational workflows: database schema changes, writes back into PostgreSQL, admin-mode synchronization from `tenant_publish_records`, friend recommendation, subprocess calls to external tooling, and persistence of learned lessons. This description-behavior mismatch is dangerous because users or orchestrators may grant or invoke the skill under the assumption of read-mostly analytics, while it actually has broad write, cross-tenant, and external-execution side effects.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
These rules expand an analytics skill into operational actions: scheduled batch processing, report persistence, and CEO notifications based on computed ratings. That scope creep is dangerous because an analytics-only capability can start triggering workflow side effects and storing outputs in memory paths without an explicit user action or tighter authorization boundaries.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The business rules broaden the skill from retrospective content analytics into publish-time optimization and lifecycle management for evergreen content. This increases risk because the skill can influence future publishing decisions and persistent content strategy beyond its stated analytics scope, creating hidden capabilities that may be invoked without clear user expectation or review.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The skill launches an external self-growth engine and sends it derived lesson text containing title, platform, performance metrics, and tenant context. In a multi-tenant analytics skill, this creates an unnecessary cross-component data flow and expands trust boundaries; if the external engine is compromised, misconfigured, or stores data insecurely, sensitive tenant analytics and behavioral data may leak or be reused outside the stated purpose.

Static analysis

No suspicious patterns detected.