Security audit
Skill 双平台同步
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed publishing helper for syncing local skills to public hubs, with expected but important account-login and public-upload behavior.
Before installing, confirm you trust the ClawHub and SkillHub CLIs and inspect the temporary publish directory before publishing. Do not put tokens, customer data, private case files, or other secrets in skills that may be uploaded to public platforms.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.