ClawHub
Back to skill

Security audit

Learning Capture

Security checks for vulnerabilities and agentic risk

Overview

This skill is a conservative note-taking helper that writes redacted project learning notes and avoids hidden execution or credential use.

Before installing, understand that this skill can create `.learnings/` markdown files in your project. Review those notes before committing or sharing the repository, and only approve promotion into durable agent instructions when you agree with the proposed rule.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- storing secrets
- copying private chat logs
- editing system/agent instructions without approval
- automatic self-modification

---
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.