ClawHub
Back to skill

Security audit

Trade Show Exhibitor Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Lensmor exhibitor-search helper that uses a disclosed API key and does not show hidden, persistent, or destructive behavior.

Install this only if you are comfortable sending trade-show, company, or audience-search details to Lensmor using your Lensmor API key. Review unlock prompts carefully because expanded access may consume credits, though the skill says not to unlock automatically.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description contains many broad natural-language trigger phrases in multiple languages, such as 'who is exhibiting' and generic 'find exhibitors' variants, without tight invocation constraints. This can cause the skill to activate in unintended contexts, leading to overbroad tool use, unnecessary external API calls, or leakage of user intent/data to the Lensmor service when the user did not clearly request this specific skill.

Static analysis

No suspicious patterns detected.