ClawHub
Back to skill

Security audit

QA Test Data Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a local test-data generator with no hidden access, but users should be careful with its production-data masking examples.

Install only if you need local QA fixture generation. Prefer fully synthetic data, do not copy raw production personal or financial data into test environments unless your legal and security requirements allow it, and treat the included masking snippets as illustrative rather than guaranteed irreversible anonymization. Review generated SQL before running it against any database.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly advises copying production data to test environments and provides masking helpers, but it does not clearly warn that production data may contain highly sensitive personal and financial information. This can lead users to move real PII into weaker test systems with insufficient minimization, irreversible leakage risk, and noncompliance with privacy or sector regulations.

Static analysis

No suspicious patterns detected.