ClawHub
Back to skill

Security audit

Chudaxia Ai Coach Tools Position Agent Skills Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only skill generator that asks the agent to create role-specific skill packages from user-provided prompts and knowledge sources.

Install this only if you want an agent to generate or update skill-package files from role prompts and selected knowledge sources. Provide a narrow output directory and only the local documents or IMA knowledge sources you intend the agent to read.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The template description uses an overly broad invocation placeholder ('Use when users need ...') without forcing concrete trigger conditions, exclusions, or scope limits. In a skill generator, this can cause downstream skills to be invoked in ambiguous or overbroad contexts, increasing the chance of unauthorized, out-of-scope, or low-quality actions being taken under the wrong skill.

Static analysis

No suspicious patterns detected.