ClawHub
Back to skill

Security audit

Rich

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Rich library guide with disclosed install and example commands, and no evidence of hidden or harmful behavior.

Install it only if you want an AI helper for the Python Rich library. Review package-install commands before allowing them, prefer a virtual environment, and be cautious with examples that enable traceback local-variable display or write logs/output files in projects containing sensitive data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The guide explicitly instructs an AI to execute package installation, environment-changing, and file-modifying commands such as installing packages and appending to requirements.txt without any safety warning, confirmation step, or sandboxing guidance. In an agent context, this can cause unintended system or project changes, dependency drift, or execution of unreviewed code from external sources, especially the git-based install path.

Static analysis

No suspicious patterns detected.