ClawHub
Back to skill

Security audit

url-shortener-mobile

Security checks for vulnerabilities and agentic risk

Overview

This is an instructions-only URL shortener skill that matches its purpose, but users should avoid shortening sensitive links because URLs are sent to public third-party services.

Install only if you are comfortable with URLs you ask to shorten being shared with public shortener services. Do not use it for login/reset links, private documents, internal hosts, signed URLs, or links containing secrets in query parameters.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill uses broad trigger language for a workflow that sends user-supplied URLs to third-party shortening services. Overbroad invocation can cause the skill to activate in unintended contexts and transmit links without clear user intent, creating privacy and consent risks rather than direct code-execution risk.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill instructs the agent to transmit user-provided URLs to external services (`da.gd`, `cleanuri.com`, `tinyurl.com`) but does not require warning the user that their URL will be shared with third parties. This is dangerous because URLs often contain sensitive query parameters, private document links, account-reset tokens, or internal hostnames that would be disclosed externally.

Static analysis

No suspicious patterns detected.