ClawHub
Back to skill

Security audit

Skill Doctor

Security checks for vulnerabilities and agentic risk

Overview

Skill Doctor is a coherent portfolio diagnostics skill that reads ClawHub listing metrics, stores local history, and only sends compact metrics to Anthropic when the user explicitly enables deep analysis.

Install only if you are comfortable letting the skill read your configured ClawHub skill/plugin metrics and keep local history under `~/.skill-doctor`. Do not use `--deep` unless you are willing to send compact portfolio diagnostics to Anthropic, and avoid storing an Anthropic API key in the config on shared machines.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README states that the skill pulls live portfolio data and supports optional Anthropic-backed analysis, but it does not clearly warn users that their portfolio metadata may be transmitted to external services or explain the privacy implications. This can lead users to unknowingly share operational or account-related data with third parties, especially when using the deep-analysis mode.

Static analysis

No suspicious patterns detected.