ClawHub
Back to skill

Security audit

Interview outline assistant

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only B2B interview workflow with normal privacy cautions around handling participant notes and quotes.

Safe to install as a workflow guide. Before using it with real participants, confirm authorization for any customer or platform data, obtain recording consent, store notes in approved confidential locations, use participant IDs instead of names where possible, and redact identifying company or role details before sharing reports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow instructs users to transcribe recordings, create per-interview records, and store respondent role/company/usage context, but gives no guidance on minimizing, anonymizing, or protecting personal and organizationally sensitive data. In a user-research skill, this omission can lead to unnecessary collection, retention, and disclosure of identifiable interview data, especially when the content may later be shared in reports or fed into AI tools.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The report template encourages verbatim quotes tied to respondent identifiers, job titles, and company size, which increases re-identification risk even if a real name is omitted. In B2B interview reporting, combining quotes with role and company context can expose sensitive opinions, internal process weaknesses, or confidential business information to unintended audiences.

Static analysis

No suspicious patterns detected.