ClawHub
Back to skill

Security audit

data-minimizer

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate local data-redaction tool, but its manifest under-declares file and command access while granting broader tools than the stated permissions.

Review the manifest before installing. The core script appears local and purpose-aligned, but the publisher should correct permissions, remove unneeded WebFetch/Write/Bash grants or justify them, and align the documented CLI and output schema with the actual script.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Scope Creep

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest claims filesystem: false, but the skill is explicitly described as taking input, producing masked output, and generating a report, which strongly implies file or local data handling inconsistent with the declared permissions. This mismatch is dangerous because policy engines or reviewers may trust the manifest and grant the skill under false assumptions, weakening containment and auditability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document's operational instructions for agents are written entirely in Chinese and do not indicate that another language may be used on user request. This creates a natural-language locale constraint without opt-in, which matches the policy-violation category for language or locale restrictions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The primary manifest description is written entirely in Chinese, which imposes a specific language in a user-facing field without any opt-in or language-selection mechanism in that field itself. Although bilingual fields exist elsewhere, this top-level description can still violate a language-choice policy for users or platforms expecting neutral or selectable locale behavior.

Content

No source excerpt is available for this finding.

Scope Creep

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest sets subprocess: false, but the interface is type: cli with entry_point: scripts/data_minimizer.py and the usage instructs running python data_minimizer.py .... Executing the skill as a command-line program requires subprocess-style invocation relative to the host agent, which exceeds the declared permission baseline.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The output schema says stdout contains JSON with per-item checks and an overall PASS/FAIL-style conclusion, while the skill description says it returns masked text plus a masking report. This contract mismatch can cause downstream automation to mis-handle outputs, potentially treating failed masking as success or forwarding unredacted sensitive data because parsers expect a different structure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring, CLI descriptions, and example usage are entirely in Chinese, and the script's prompts and status messages also appear only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the tool clearly documents a justified region-specific scope, which this file does not.

Content

No source excerpt is available for this finding.