ClawHub
Back to skill

Security audit

宽数题库

Security checks for vulnerabilities and agentic risk

Overview

This is a simple project-helper skill with normal build and deployment notes, but its production Vercel deploy command should be used deliberately.

Install is reasonable if you want a project reference for this private repository. Before running commands, review the repository scripts, and only run the Vercel production deploy command when you intend to publish the current build to the public site using the active Vercel account.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill includes a production deployment command for Vercel (`npx vercel deploy dist --prod --yes`) and explicitly references a public site, but it does not warn that running the command will publish changes live. In an agent context, this increases the chance of unintended public deployment, especially because `--prod --yes` removes confirmation prompts and makes accidental release easier.

Static analysis

No suspicious patterns detected.