ClawHub
Back to skill

Security audit

onboarding

Security checks for vulnerabilities and agentic risk

Overview

This skill provides onboarding and activation advice and does not include hidden execution, persistence, credential use, or broad data access.

Install this if you want help with post-signup onboarding, activation, and first-run experience. Be aware that it may read a small set of product-marketing context files in your workspace to tailor advice, and its trigger wording may overlap with general retention or re-engagement questions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The eval explicitly rewards triggering on very casual phrasing like 'users sign up but then never come back,' which broadens skill activation beyond tightly scoped onboarding requests. In an agent-routing system, this can cause the onboarding skill to fire for ambiguous retention or lifecycle-marketing problems, increasing the chance of inappropriate guidance, overbroad tool use, or misrouting away from more suitable skills.

Static analysis

No suspicious patterns detected.