ClawHub
Back to skill

Security audit

Expert2Skill - From Expert to Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local generator for expert-rule skills; it creates local files and scripts but does not hide network access, credential use, or automatic publishing.

Install only if you want a tool that can generate local skill packages and executable Python evaluators. Review generated skills before publishing, especially health, investment, or legal ones, and avoid pointing upload checks at broad private directories.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill explicitly instructs use of local file reads/writes and shell execution via `scripts/distill.py`, `scripts/package_skill.py`, and generated evaluators, yet it declares no permissions. This creates a trust-boundary mismatch: reviewers or runtime policy engines may treat it as low-risk while it can modify local files, run commands, and process directories, increasing the chance of unsafe execution or abuse if the packaging flow is manipulated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
82% confidence
Finding
The documented purpose understates the operational behavior: beyond interview-based distillation, the skill packages runnable code, performs upload checks, runs local scanners, and auto-classifies sensitive domains. This mismatch is dangerous because users may consent to a benign-sounding interview tool without realizing it will generate executable artifacts and invoke local tooling, which materially expands attack surface and execution risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The schema explicitly defines collection of sensitive health-related profile fields such as disease history, age, and weight, but the document provides no privacy notice, consent flow, minimization guidance, retention policy, or handling constraints. In a meta-skill that helps generate reusable skills, this omission can propagate into downstream implementations that collect regulated or highly sensitive personal data without adequate safeguards.

Static analysis

No suspicious patterns detected.