ClawHub
Back to skill

Security audit

landlord-deposit-defender

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local, user-directed tool for organizing security-deposit evidence and drafting dispute letters, with no hidden network, credential, persistence, or destructive behavior found.

Install only if you are comfortable running a local Python CLI on your own inventory and deduction files. Treat the generated legal references as decision support, not legal advice, and verify current local law before relying on a deadline or amount.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises executable commands that read and write local files and invoke Python via the shell, but the metadata does not declare any permissions or capability boundaries. That mismatch is dangerous because an agent or reviewer may treat the skill as lower-risk than it really is, while the documented workflows operate on arbitrary file paths and shell-invoked scripts.

Static analysis

No suspicious patterns detected.