ClawHub
Back to skill

Security audit

Clean Filename

Security checks for vulnerabilities and agentic risk

Overview

This is a small local filename-cleaning tool that can rename user-selected files but shows no hidden network access, credential use, or persistence.

Use --dry-run before running this on important, shared, or project folders. Be especially careful with --recursive because renamed files can break links, scripts, imports, or workflows that depend on exact filenames.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill advertises filename cleaning but does not clearly warn that executing it will rename files on disk, which is a state-changing operation that can affect many files at once. Users may treat it as a harmless formatting or preview utility and unintentionally trigger bulk renames, causing workflow disruption, broken references, or accidental data-management issues.

Static analysis

No suspicious patterns detected.