ClawHub
Back to skill

Security audit

Website Security Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed website-safety audit workflow that opens user-provided URLs and checks public trust signals, with no evidence of hidden persistence, credential theft, or destructive behavior.

Install this if you want a structured workflow for checking whether websites look trustworthy. Use it only for public sites or links you are comfortable opening in a browser; avoid internal systems, private URLs, login pages, or pages containing sensitive data. Treat the optional local ProSearch command as an environment-specific helper, not a required step.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill instructs running a local Node.js script with user-influenced input to perform online search, which expands the skill from passive analysis into local code execution. Even if the script is intended as a helper, invoking external executables increases attack surface and can enable command/argument injection, unsafe script modification abuse, or execution of unreviewed local code on the host.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill directs the agent to browse arbitrary user-supplied URLs and query external services without an explicit warning or consent flow. This can leak user-provided targets to third parties, trigger network access to sensitive/internal endpoints if not constrained, and expose the environment to malicious web content during analysis.

Static analysis

No suspicious patterns detected.