ClawHub
Back to skill

Security audit

Chess Buddy

Security checks for vulnerabilities and agentic risk

Overview

Chess Buddy is a coherent chess-analysis skill that runs a local Stockfish engine and does not show hidden persistence, credential access, data exfiltration, or destructive behavior.

Safe to install for chess analysis if you are comfortable running a local Stockfish binary. Install Stockfish from a trusted source, keep STOCKFISH_PATH under your control, verify image-derived positions before relying on engine output, and do not use the skill to cheat in active human or rated games.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The helper will execute any local binary specified via --engine or STOCKFISH_PATH, which means untrusted input can cause arbitrary program execution under the privileges of the agent or user running the skill. In the context of a chess-analysis helper, this is broader than necessary and increases danger because the feature is exposed as part of a benign-looking utility where callers may reasonably expect only Stockfish to run.

Static analysis

No suspicious patterns detected.