ClawHub
Back to skill

Security audit

Creator Content Auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent influencer-content auditing workflow that reads campaign evidence, produces a review, and only persists an audit artifact after user approval.

Installers should expect this skill to read campaign and creator evidence and to produce go/no-go audit guidance. Before allowing persistence, confirm the target audit path and artifact contents, especially when the review may affect publication approval or payment milestones.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Persistence

Ask before writing. On approval, validate the complete v3 draft with `validate-audit-artifact.py` against the intended `memory/audits/influencer/YYYY-MM-DD-<topic>.md` relative path, persist only through one full-content Write, and revalidate the target per the auditor runbook. Edit/shell/MCP mutations of the reserved sink are unsupported. Do not autonomously modify claims, contracts, registry records, candidates, or hot cache.

## Reference Materials
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.