ClawHub
Back to skill

Security audit

Porter's Five Forces

Security checks for vulnerabilities and agentic risk

Overview

This skill provides a coherent business-analysis framework without requesting sensitive access or automated actions.

Use this as a structured analysis aid and verify current industry figures before making business or investment decisions. The package requires no additional software or account credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · examples/ai-foundation-model-industry-structure-2024-2026.md (reported line 17)May include surrounding context.

md
ontier, with high fixed costs (each training run is enormous and largely sunk), little durable differentiation at the model layer as leaders leapfrog each other on successive releases, and aggressive price competition. Every capability lead is temporary; rivals match it within months.

**Step 3 — Binding force.** The single most binding force is **supplier power over compute**. The labs compete fiercely (rivalry) and face substitution from open weights, but the structural feature that most limits their profitability is that an indispensable, concentrated input — advanced accelerators from Nvidia, fabricated by TSMC — sits upstream and captures much of the value created. Intense rivalry and low buyer switching costs then ensure that whatever margin survives the compute bill is competed away rather than retained. The residual left for the model labs is thin relative to the value moving through them.

**Step 4 — Strategic response.** With supplier power binding, the classic move i

Static analysis

No suspicious patterns detected.