ClawHub
Back to skill

Security audit

comment-md

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it loads third-party web scripts while showing potentially private Markdown, so it needs user review before installation.

Install only if you are comfortable with the reviewed Markdown and comments being visible to browser scripts loaded from jsDelivr. Avoid highly confidential documents unless the dependencies are vendored or otherwise pinned and verified; the local file/output behavior itself appears coherent and non-destructive.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to read an arbitrary Markdown path, launch a local HTTP server, open a browser, and then read and write review artifacts, which clearly exercises file read, file write, and network capabilities without declaring them. Undeclared capabilities are dangerous because they bypass least-privilege review and make it harder for operators to understand the skill's trust boundary, especially since the input path can be relative or absolute and the workflow exposes local content over HTTP.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The viewer fetches executable JavaScript from third-party CDNs at runtime for a workflow that is supposed to review local Markdown safely. If the CDN, dependency, network path, or corporate proxy is compromised, arbitrary script can run in the review page and access the rendered document, user comments, and submission flow, turning a local-review tool into a remote code execution and data exfiltration surface.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
In server mode, clicking the finish button silently POSTs user-authored comments to /api/finish without a clear user-facing disclosure that review content will be transmitted over the network. In this skill context, comments may contain sensitive feedback, internal design details, or excerpts from proprietary Markdown, so hidden transmission increases confidentiality risk and can violate user expectations for a 'local' review flow.

Static analysis

No suspicious patterns detected.