ClawHub
Back to skill

Security audit

tiered-audit

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent code-audit workflow that mainly runs read-only git analysis and writes local findings files, with full-codebase review gated on explicit user approval.

Install this only if you want generic audit/review requests to be eligible for this tiered audit workflow. Be aware it may run git-history analysis and write local findings files, and review any separate Night Market or Claude Code plugin before installing that fuller integration.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes broad, common terms such as 'audit', 'review', and 'code-quality', which can cause the skill to activate in contexts far beyond its intended scope. In an agent environment, unintended invocation can lead to unnecessary repository inspection, command execution suggestions, or workflow hijacking when a user meant a different tool or built-in capability.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
96% confidence
Finding
Using the trigger 'review' conflicts with a likely built-in command of the same name, creating shadowing behavior where this skill may intercept requests intended for the platform's native review function. That can misroute user intent, alter expected safeguards, and cause the agent to follow this skill's workflow instead of the trusted built-in path.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.