ClawHub
Back to skill

Security audit

架构设计

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to create architecture documentation, with only a low-risk concern that it may save a local Markdown file by default.

Before installing, make sure you are comfortable with the agent creating a local Markdown architecture document in the workspace. Avoid using it on highly sensitive repositories unless you control the output path and understand that the generated file may contain internal design details.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs the agent to save the generated architecture document as a local Markdown file by default, but it does not require explicit user confirmation, specify a safe destination, or explain that a filesystem write will occur. In agent environments with file-write privileges, this can cause unintended persistent side effects, overwrite existing files, or create artifacts containing sensitive architecture details without the user's informed consent.

Static analysis

No suspicious patterns detected.