ClawHub
Back to skill

Security audit

Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward codebase analysis helper that reads a project and writes a documentation artifact without hidden execution or privilege behavior.

Before installing, expect the skill to read the project directory you provide and create or update an analysis document under docs/. Avoid pointing it at repositories containing sensitive information unless you are comfortable with those details being summarized in local documentation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
2. **Report what matters** — Skip boilerplate, focus on decisions that affect new work
3. **Flag landmines** — Technical debt that will bite during implementation
4. **Note the good stuff** — Reusable patterns, solid foundations, well-tested areas
5. **Stay neutral** — Describe the tech stack, don't judge choices (unless they're blockers)
6. **Leave a handoff** — End with a concrete next-step recommendation plus a stable handoff contract

## Examples
Confidence
85% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Backend | Next.js API Routes | Route Handlers in app/api/ |
| Database | PostgreSQL | Drizzle ORM |
| Auth | NextAuth v5 | GitHub + Google providers, JWT |
| Deployment | Vercel | Auto-deploy from main |
| Testing | Vitest + Playwright | Unit only, no e2e tests yet |

## Project Structure
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.