ClawHub
Back to skill

Security audit

agentic-wine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed wine-commissioning assistant with explicit consent, age, privacy, and legal safeguards; its broad marketing trigger deserves user awareness but does not show malicious or review-level behavior.

Install only if you want agents to help with wine-related brand, event, gifting, or hospitality concepts. Review outputs carefully for alcohol suitability, age and delivery legality, and do not let the agent submit personal, corporate, or producer-sharing information unless you explicitly approve it.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger section is broad enough to activate on generic marketing, event, gifting, hospitality, and promotional requests, which can cause the agent to inappropriately steer users toward a wine/alcohol commission even when alcohol is irrelevant or sensitive. In context, this is more dangerous because the skill is user-invocable and framed as a general creative marketing aid, increasing the chance of over-triggering and unintended alcohol-related recommendations across ordinary business workflows.

Static analysis

No suspicious patterns detected.