ClawHub
Back to skill

Security audit

Quantics Bank

Security checks for vulnerabilities and agentic risk

Overview

This is a project guide for a Quantics Bank question-bank site, with one operational deployment command that users should run carefully.

Install is reasonable if you want a reference guide for this project. Treat the command snippets as operational instructions: confirm the current directory, Vercel account, target project, build output, and intent before running the production deploy command, and expect the data-fetch commands to contact the listed external question sources.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill includes a ready-to-run production deployment command (`npx vercel deploy dist --prod --yes`) that performs a non-interactive public release with no warning, confirmation step, or guardrails. In an agent skill, this is risky because a user or agent following the instructions could accidentally publish unreviewed, sensitive, or private content to a public endpoint immediately.

Static analysis

No suspicious patterns detected.