ClawHub
Back to skill

Security audit

Dog Train-O-Matic

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent dog-training helper with a local progress log and professional-referral guardrails, with no evidence of hidden data access or harmful behavior.

Before installing, understand that the skill may run its included Python script and keep a local training log. Use it for ordinary training structure, but consult a veterinarian or credentialed behavior professional for aggression, bites, severe anxiety, pain, sudden behavior changes, respiratory limits, heat risk, injury, puppies, or senior-dog concerns.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation instructs the agent to invoke local shell commands and a Python script, and the workflow includes logging and plan regeneration behaviors that imply file writes, yet the manifest declares no permissions. This mismatch is dangerous because it can bypass user and platform expectations about what the skill is allowed to do, increasing the risk of unauthorized command execution or filesystem modification if the runtime honors the instructions.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This file gives prescriptive, breed-specific exercise and behavior guidance but does not state that the material is general education rather than veterinary or certified behaviorist advice. In a pet-training skill, users may rely on it for puppies, seniors, brachycephalic breeds, injured dogs, or dogs with aggression/anxiety issues, creating risk of overexercise, worsening behavior, or delayed professional care.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/test_dog_trainer.py:11