ClawHub
Back to skill

Security audit

AI Governance Policy Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a policy-template skill with no executable code or automatic access, though users should treat its governance advice and external links carefully.

Before using this skill, avoid pasting confidential, personal, regulated, or proprietary business data into the assistant unless your organization has approved that workflow. Have legal, privacy, security, and HR stakeholders review any policies or monitoring practices before adoption, and treat the AfrexAI and Stripe links as external commercial sites that may receive visit metadata if opened.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill gives operational guidance on AI governance, shadow AI monitoring, vendor evaluation, and incident response that could lead users to process sensitive organizational, employee, or customer data. While it discusses data classification and compliance concepts, it does not include an explicit upfront warning to avoid inputting confidential data into the skill output flow or to obtain legal/compliance review before acting on jurisdiction-specific policy guidance, which creates a meaningful safety gap.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill includes promotional outbound links to third-party sites and a payment page without warning users that clicking them may disclose organizational interest, referral metadata, IP information, or procurement intent to external services. In an enterprise governance context, even metadata about which compliance materials or AI products an organization is considering can be sensitive.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.