ClawHub
Back to skill

Security audit

Zig Pro Maxx

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-style Zig coding skill with no install-time behavior, persistence, credential access, or hidden execution; the main risks are accuracy problems in sample code rather than security abuse.

This skill appears safe to install from a security standpoint, but users should treat its Zig examples as guidance to compile and verify rather than as authoritative truth. Pay particular attention to allocator ownership and Zig 0.16 API details until the publisher audits the flagged examples.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

High
Confidence
97% confidence
Finding
This is a real integrity and safety issue: the skill asserts strict Zig 0.16.0 compliance while its own canonical examples appear to use APIs that the document elsewhere says are changed or obsolete for that version. In a code-generation skill, contradictory guidance can systematically induce broken code, unsafe substitutions, or user trust in invalid patterns, especially because the examples are framed as patterns to copy exactly.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The example shows a function declared to return `!Config` while allocating a `*Config` and then returning `result.*`, which copies out the value and loses the ownership relationship to the heap allocation. In allocator-focused reference documentation, this is dangerous because readers may cargo-cult a pattern that leaks memory, mismanages lifetimes, or encourages confusion between owning pointers and value returns.

Static analysis

No suspicious patterns detected.