ClawHub
Back to skill

Security audit

karpathy-principles

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only coding-quality checklist; some trigger phrases are broad, but it does not execute code or request sensitive access.

Install this if you want an agent to apply a stricter coding-process checklist before and after implementation. Expect it to slow some coding tasks and occasionally activate from broad phrases; disable or rename triggers if you prefer explicit invocation only.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger 'starting implementation to verify the approach' is broad and likely to occur in ordinary coding conversations, which can cause unintentional activation of the skill. Accidental invocation can steer agent behavior unexpectedly, inject additional process requirements, and interfere with user intent or other skills.

Vague Triggers

Medium
Confidence
95% confidence
Finding
Several triggers such as 'karpathy', 'synthesis', 'discipline', and 'TDD' are ambiguous and overlap with normal software discussion, making accidental activation likely. In an agentic environment, this creates prompt-routing risk where the wrong skill may activate and alter planning, verbosity, or workflow without clear user intent.

Static analysis

No suspicious patterns detected.