ClawHub
Back to skill

Security audit

corp-innovation-brief

Security checks for vulnerabilities and agentic risk

Overview

This skill generates a company innovation and credit-analysis brief using patent, paper, and public web data, with a disclosed optional HTML export after user confirmation.

Install only if you intend to use PatSnap MCP and public web search for company credit-analysis reports. Expect the skill to retrieve company patent, paper, and public-risk information, and to create local report files only when export or the helper pipeline is run.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill includes executable Python that reads an environment variable and writes an HTML file, but no explicit permissions are declared. That creates a capability/expectation gap: users or the platform may treat the skill as data-retrieval-only while it can persist files and interact with runtime environment configuration. In this context the code path is limited to report export, so the risk is not arbitrary RCE, but undeclared file-write capability is still a real security and governance issue.

Static analysis

No suspicious patterns detected.