ClawHub
Back to skill

Security audit

flowX

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill benign because the reported workflow-related capabilities were judged consistent with its purpose, though the overall confidence is medium and one scanner reported a caution-level risk assessment.

The verdict is benign, not a guarantee of zero risk. Skillspector’s scan was partial because it could not resolve some local path-like references, so evidence is incomplete despite all listed components being scanned. Before installing, consider whether the reported capabilities fit your needs and whether you are comfortable with the skill’s undeclared tool scope; runtime permission enforcement was not verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/plugin_settings.py (reported line 52)May include surrounding context.

python
and os.path.normpath(python) != os.path.normpath(sys.executable)
            and not os.environ.get(_REEXEC_GUARD)):
        os.environ[_REEXEC_GUARD] = "1"
        os.execv(python, [python, *sys.argv])
    key = saved.get("apiKey")
    if isinstance(key, str) and key:
        os.environ["FLOWX_LLM_API_KEY"] = key

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
- Reuse a suitable existing workflow when it meets the request. Before running,
   check it has the necessary built artifacts and no relevant unresolved errors;
   review its code and service binding as below. A matching but incomplete,
   stale, or failed workflow is not automatically runnable: inspect and explain
   what needs repair or completion rather than claiming success.
- If a candidate needs changes, explain the proposed evolution or repair and
   obtain authorization before modifying it. If several plausible workflows

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/build.py (reported line 63)May include surrounding context.

python
def build_options(parser: argparse.ArgumentParser, *, cascade: bool = False, default_cascade: bool = True) -> None:
    parser.add_argument("--temperature", type=float, default=0.35)
    parser.add_argument("--max-retries", type=int, default=1, help="Extra attempts per stage")
    parser.add_argument("--auto-repair", action="store_true", help="Repair failing node tests without asking")
    if cascade:
        group = parser.add_mutually_exclusive_group()
        group.add_argument("--cascade", dest="cascade", action="store_true", help="Rebuild dependent stages")