ClawHub
Back to skill

Security audit

harden

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed security-hardening skill that scans a repository and only changes code after user approval or an explicit auto-apply option.

Install this when you want repository-wide security hardening. Because it may scan a lot of local code and can create commits or GitHub-facing artifacts after approval or auto-apply, keep first runs in report-only mode and review each proposed change before enabling auto-apply.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger list is broad and includes generic terms like "security," "python," "rust," and "cwe," which can cause the skill to activate in contexts where the user did not intend a repository-wide hardening workflow. In an agent setting, unintended invocation increases the chance of unnecessary scanning, proposal generation, or follow-on tool use on sensitive codebases.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
modules/cross-cutting.md:26