ClawHub
Back to skill

Security audit

cn-holidays

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward China holiday lookup tool that uses the disclosed Nager.Date public API and does not show hidden data access, persistence, or destructive behavior.

Before installing, be aware that each lookup contacts Nager.Date over the network. This is expected for the tool, but it may not fit offline or privacy-restricted workflows.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
94% confidence
Finding
The script makes outbound requests to a third-party public API but does not clearly disclose this behavior to the user at runtime beyond a source comment. This can surprise users, expose metadata such as IP address and query timing to the external service, and may violate expectations in restricted or privacy-sensitive environments.

Static analysis

No suspicious patterns detected.