ClawHub
Back to skill

Security audit

Renesas Search

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-style Renesas datasheet research skill whose network use and local PDF downloads are disclosed and aligned with its purpose.

Before installing, understand that using the skill can download Renesas datasheet PDFs into your current workspace under embedded_dev/renesas/datasheet/. Use it in a workspace where those files are acceptable, and periodically remove old PDFs if storage or workspace cleanliness matters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The README explicitly states that the skill will download datasheet PDFs into a local working-directory path, but it does not clearly warn the user at execution time that files will be created and persisted. This is a real but low-severity issue because it introduces side effects on the local filesystem that may be unexpected in agent workflows, especially in shared or automated environments.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs the agent to create directories and download PDFs into the current working directory without requiring user confirmation or warning about local filesystem changes. In an agent environment, this can cause unexpected writes, workspace pollution, overwriting of existing files, or storage abuse, especially if triggered repeatedly or in sensitive directories.

Static analysis

No suspicious patterns detected.