ClawHub
Back to skill

Security audit

build-oled-technology-intelligence-rd

Security checks for vulnerabilities and agentic risk

Overview

This skill builds a local, evidence-traceable technology intelligence portal and its file, command, and optional research behavior is disclosed and proportionate to that purpose.

Install this if you want an agent to build local HTML intelligence portals from reviewed technology evidence. Expect it to read its bundled guidance files, run the included Python renderer, write portal files to an output directory you choose, and potentially use external research or patent tools when the requested scope requires current evidence.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to read multiple local files, run a Python script, write portal output files, and optionally query external evidence sources, which together imply file_read, file_write, and network capabilities. Because these capabilities are not explicitly declared, the runtime may grant broader access than users or policy reviewers expect, increasing the chance of unintended data access, outbound requests, or file creation during execution.

Vague Triggers

Medium
Confidence
72% confidence
Finding
The invocation description is broad enough to match many generic requests for portals, monitoring briefs, trackers, or intelligence sites across multiple domains, not just OLED. In combination with the skill's instructions to read bundled materials, perform searches, and render files, overbroad triggering could cause the agent to invoke a relatively powerful skill in contexts where the user did not clearly request those actions.

Static analysis

No suspicious patterns detected.