ClawHub
Back to skill

Security audit

A precision tool designed for distilling high-fidelity professional concepts and relationships from complex information. It automatically organizes knowledge into a 3-layer architecture (Core, Primary, Detail) and ensures semantic consistency through recursive entity tracking. This skill enables any AI to act as a structured knowledge engine, generating consistent, graph-ready data for interactive learning.

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill structures professional text into a JSON knowledge graph and does not request tools, credentials, network access, persistence, or system changes.

Install only if you want responses for applicable professional analysis tasks to be returned as structured JSON knowledge graphs; expect it may activate broadly unless its trigger description is narrowed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description says the skill performs "Professional multi-layered knowledge extraction and recursive knowledge graph construction" but does not define clear trigger phrases, scope boundaries, or exclusion conditions. For a markdown/manifest file, this is an ambiguous invocation description that may cause the skill to match a wide range of generic analysis or summarization requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.