ClawHub
Back to skill

Security audit

Ticketmax

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward receipt-printer helper; its physical printing actions are visible and aligned with its purpose.

Install only if you intend agents to send content to a real configured printer. Confirm PRINTER_ADDR before use, review sensitive text before printing, and prefer a pinned or reviewed ticketmax version if supply-chain reproducibility matters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
87% confidence
Finding
This markdown file describes direct printing to a thermal receipt printer and later documents control features like paper cutting and buzzer activation, but it does not explicitly warn users that invoking the skill will trigger physical device actions. Because the skill can consume stdin or files and send output to a real printer, a brief disclosure would help prevent unintended prints or device actions.

Hidden Instructions

High
Category
Prompt Injection
Content
| `\| A \| B \| C \|` | Three columns |
| `![alt](path)` | Image (PNG, JPEG, GIF) |
| `` ```qr `` | QR code block |
| `<!-- cut -->` | Cut paper |
| `<!-- beep -->` | Buzzer (1 beep) |
| `<!-- beep N -->` | Buzzer (N beeps) |
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
| `\| A \| B \| C \|` | Three columns |
| `![alt](path)` | Print image (PNG, JPEG, GIF) |
| `` ```qr `` | QR code block |
| `<!-- cut -->` | Cut paper |
| `<!-- beep -->` | Buzzer (1 beep) |
| `<!-- beep N -->` | Buzzer (N beeps) |
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Static analysis

No suspicious patterns detected.