ClawHub
Back to skill

Security audit

测试评估

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AI-agent testing skill that generates evaluation cases and reports, with only disclosed local/reporting writes to watch for.

Before using it, specify where reports and test cases should be written, and approve any Git commits or issue creation explicitly. Do not give it access to repositories or project trackers unless you want evaluation artifacts posted there.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
95% confidence
Finding
The skill states that it will output results to a local Markdown file by default, but it does not clearly warn the user that local files may be created or modified. In an agent context, undocumented filesystem writes can violate user expectations, cause accidental overwrites, or create privacy and auditability issues, even if the content itself is benign.

Static analysis

No suspicious patterns detected.