ClawHub
Back to skill

Security audit

Soc2 Evidence Collector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a SOC2 evidence-package generator whose sensitive data collection is expected for its audit purpose, but users should handle generated evidence files carefully.

Before installing or using this skill, review any generated scripts, run them only with least-privilege audit/read-only credentials, store the soc2-evidence output securely, and redact sensitive values before sharing with auditors or vendors.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README promotes automated evidence-collection scripts for AWS, GitHub, and identity platforms, but it does not warn that these scripts will require privileged credentials and may access sensitive configuration, audit, and user data. In a compliance context, users may trust the automation and grant broad access without understanding the security implications, increasing the risk of credential overreach, data exposure, or unsafe script execution.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill includes ready-to-run evidence collection scripts that export IAM, network, logging, encryption, and repository security data into local files, which can contain highly sensitive internal security configuration and identity information. Although it briefly advises users to review and redact before sharing, it does not provide an upfront warning, data minimization guidance, secure storage requirements, or safeguards against over-collection and local exposure, making accidental disclosure reasonably likely.

Static analysis

No suspicious patterns detected.