Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward ClawHub analytics helper that stores limited local recommendation state and fetches public skill metrics.
Before installing, understand that the skill will keep local analytics state in memory/skill-analytics/ and may update those files after runs. It should not need credentials, private files, external packages, or shell commands.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## What This Skill Does NOT Do
- Does NOT read MEMORY.md, SOUL.md, or other workspace files
- Does NOT access credentials or private data
- Does NOT use external CLI tools or npm packages
- Does NOT modify any files outside `memory/skill-analytics/`
The invocation examples include broad requests like adoption strategy, growth advice, and 'how is my skill doing' without tightly constraining the skill to analytics-only behavior. In agentic environments, vague triggers can cause the skill to activate in contexts where file writes and web lookups are unnecessary or unexpected, increasing the chance of overreach and unanticipated state changes.
The skill persists local state across runs but does not surface an explicit user-facing warning near the state file behavior. This can lead to silent retention of recommendation history and run metadata, which is a transparency and consent problem even if the stored data is not especially sensitive.
No suspicious patterns detected.