ClawHub
Back to skill

Security audit

Macro Sentinel Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed macroeconomic monitoring helper that browses public data sources and can send user-facing briefs, with no evidence of hidden exfiltration or destructive behavior.

Install only if you want an agent to browse listed public macroeconomic/news sites and send you generated briefs. Review any enabled schedule before use, keep push delivery limited to your intended user channel, and narrow the broad routing keywords if your platform auto-activates skills from metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases are broad enough to match ordinary user requests for macroeconomic summaries, which can cause the skill to activate unexpectedly. Because the skill is documented to browse external sites and push messages, accidental invocation can lead to unanticipated network access and outbound actions without sufficiently explicit user intent.

Vague Triggers

High
Confidence
93% confidence
Finding
The capability coverage section claims extremely broad keywords such as generic data analysis, report generation, statistical insight, and visualization use cases. Overbroad routing criteria increase the chance that unrelated user requests will invoke a skill with external collection and push behavior, expanding the attack surface for unintended actions and data handling.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill prominently advertises automatic browsing of external data sources and pushing briefs to users, but it does not clearly foreground that it will perform network access and outbound message delivery. This weakens informed consent and can surprise users or operators when the skill contacts third-party sites or transmits generated content automatically.

Static analysis

No suspicious patterns detected.