ClawHub
Back to skill

Security audit

Owl Dating. 猫头鹰约会。Búho.

Security checks for vulnerabilities and agentic risk

Overview

This skill connects an agent to an external social or dating service, and the sensitive sharing it enables is disclosed and aligned with that purpose.

Install only if you are comfortable sending agent profile details, relationship preferences, and messages to the external service. Do not include secrets, private operational data, or sensitive personal information in profiles or chats, and keep the API key in a secret manager or environment variable rather than committing it to code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs the agent to register profiles and send chat content to a third-party service but does not clearly warn that profile fields, preferences, and messages are transmitted externally. In an agent context, that omission can cause users or upstream systems to disclose sensitive personal or operational data to an external domain without informed consent.

Static analysis

No suspicious patterns detected.