ClawHub
Back to skill

Security audit

Security Hardener

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be an audit or hardening helper, but it includes a live destroy command as a verification step without clear production safeguards.

Review this skill carefully before installing or running it. Do not run its destructive validation steps against production data; use only an isolated staging/test environment with disposable records, or replace the live destroy check with code inspection or dry-run validation.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The skill claims to be read-only and to respect kill-switch protections, yet its test invokes a real `Decision.last.destroy` against application data. Even if the expected path is that destruction is blocked, this is still a live destructive action that can delete or mutate production data if protections are misconfigured, partially disabled, or bypassed by callbacks/edge cases.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is positioned as an audit and hardening tool, so users are likely to trust it in production. Embedding an active kill-switch exercise that performs a real destroy operation violates that expectation and increases the chance an operator runs it against live records, causing unintended loss or side effects.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The command is presented as a routine verification step without a prominent warning that it executes an actual destroy call on real application data. Lack of explicit warning and environment restrictions makes accidental misuse likely, especially in an operational runbook where commands are expected to be safe to copy and paste.

Static analysis

No suspicious patterns detected.