ClawHub
Back to skill

Security audit

schema

Security checks for vulnerabilities and agentic risk

Overview

This skill provides structured-data guidance and examples without hidden execution, persistence, or unrelated data access.

Installers should understand that the skill may read local product-marketing context files if present to tailor schema recommendations. Review generated JSON-LD for accuracy against visible page content and validate it with structured-data testing tools before deploying.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The eval explicitly rewards the skill for triggering on vague, casual phrasing ('add schema to our blog posts') without requiring stronger routing constraints or disambiguation. In an agent setting, this can cause over-broad activation, leading the schema skill to respond when the user may need a different SEO, content, or engineering workflow, increasing the chance of incorrect actions or misleading guidance.

Static analysis

No suspicious patterns detected.