ClawHub
Back to skill

Security audit

Convert Spreadsheet Rows

Security checks for vulnerabilities and agentic risk

Overview

This looks like a mostly local spreadsheet-to-task converter, but it asks for an unexplained API key and underspecifies its write behavior.

Review before installing if you handle sensitive spreadsheets or secrets. Do not provide an API key unless the publisher names the service, explains why it is needed, and discloses what data is sent. Use explicit input and output paths, expect CSV-focused behavior, and inspect generated Jira/Markdown/JSON before importing it into another system.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
Documenting a required API key without explaining the external dependency is a security-relevant issue because it encourages users to provision secrets to a skill whose data flows are unclear. In an agent-skill context, this can normalize unnecessary credential exposure and increase the risk of secret misuse, exfiltration, or accidental transmission to an unspecified third-party service.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
Documenting a write mode without warning that it may create or modify data is dangerous in an agent environment because users may invoke it assuming read-only behavior. That can lead to unintended overwrites, creation of incorrect artifacts, or propagation of transformed data into downstream systems like Jira without operator awareness.

Missing User Warnings

Low
Confidence
88% confidence
Finding
Listing an API key requirement without any credential-handling guidance is a real security issue because users may place secrets in insecure files, logs, or command histories. In a skill ecosystem, unclear secret practices materially increase the chance of credential leakage and unauthorized external data access.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation condition is broad and ambiguous: it can be invoked for converting spreadsheet rows into multiple output formats without clear constraints on allowed inputs, trust boundaries, or data sensitivity. In an agent setting, overly broad routing increases the chance the skill is applied to sensitive spreadsheet content unnecessarily, which can lead to unintended data exposure, over-processing, or use in contexts the author did not anticipate.

Static analysis

No suspicious patterns detected.