ClawHub
Back to skill

Security audit

Critical Thinking

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only critical-thinking skill that guides structured analysis and does not request system access or perform actions.

Install this as a reasoning aid, not as an authority to make decisions for you. It may activate for broad high-stakes evaluation scenarios, so users should keep final judgment and any real-world actions under explicit human control.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The manifest description starts with several specific trigger phrases, but then expands activation to broad conditions like 'user needs to evaluate a high-stakes claim' and 'user suspects motivated reasoning or a team is converging too fast.' Those conditions are subjective and could overlap with many ordinary discussions, making invocation boundaries unclear despite the presence of some negative examples.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Red Flags

- Only one hypothesis is being considered
- "Supporting evidence" accumulated without checking against alternatives
- Conclusion reached before the analysis (motivated reasoning)
- No matrix or equivalent structured comparison exists
- No statement of linchpin assumptions / what would change the conclusion
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.