ClawHub
Back to skill

Security audit

API Contract Tester

Security checks for vulnerabilities and agentic risk

Overview

The inspected skill content is repo-focused developer guidance with high-impact commands disclosed and generally gated by user intent or confirmation.

Install only if you expect repo-maintenance behavior: these skills can run local tooling, use authenticated GitHub or ClawHub moderator commands, and in one review helper default to full-access nested Codex review. Review the commands before running moderation, publishing, deploy, or proof workflows.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:39