ClawHub
Back to skill

Security audit

agent-verifier

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate pre-send message safety library, with sensitive-data handling that users should configure carefully.

Before installing, decide where audit results will be stored and what redlist file the library may read. If enabling the optional LLM check, use an approved provider or local model because message body, subject, recipient, and campaign can be included in the prompt.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation indicates capabilities that read local files (for redlists and vendored code paths) and write per-message audit logs, but no permissions are declared. That mismatch can lead integrators to grant or assume broader filesystem behavior than is transparently documented, weakening review and sandboxing controls for a component intended to sit in a sensitive outbound approval path.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The verifier sends subject, body, recipient, and campaign content to an external LLM callable for semantic review, which can expose sensitive outbound message data to a third-party processor or logging layer without any built-in consent, disclosure, minimization, or trust-boundary enforcement. In this skill’s context, that is especially relevant because the tool is explicitly meant to inspect potentially confidential pre-send content, so the semantic check can become a data exfiltration path rather than a protection layer.

Static analysis

No suspicious patterns detected.