ClawHub
Back to skill

Security audit

Supplier Reconciliation Desk

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple supplier-name reconciliation helper that uses only user-provided input and does not request file, credential, network, or execution access.

This appears safe to install for routine supplier-name matching. Users should still provide only the supplier data needed for the current reconciliation task, since the skill returns business matching decisions based on the input it is given.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.