Security audit
20 Agent Security Questions
Security checks for vulnerabilities and agentic risk
Overview
The skill bundle is a coherent set of ClawHub maintainer and Convex workflow helpers, with sensitive actions mostly disclosed and gated by user confirmation or existing auth checks.
Install only if you want these ClawHub maintainer and Convex workflow automations. Treat the moderation skill as staff-only because it can ban users, change roles, and affect public skill visibility through authenticated APIs. Review the autoreview helper before use if your environment has sensitive files, because its default nested Codex mode uses full-access sandbox bypass unless run with the opt-out flag.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.