ClawHub
Back to skill

Security audit

Minimalist

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed coding-style helper that pushes for smaller code changes and does not show hidden access, network activity, credential use, or destructive behavior.

Install this if you want coding responses to consistently favor small, simple, dependency-light changes. Be aware it may push back on speculative scope and remain active across coding replies until disabled with the documented off command.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill declares applicability to "ANY coding task" and several vague user cues, which makes automatic invocation overly broad and increases the chance it will activate outside the user's actual intent. In an agent system, broad trigger criteria can cause persistent behavioral override of normal task routing, leading to inappropriate minimization decisions in sensitive coding contexts.

Vague Triggers

High
Confidence
97% confidence
Finding
The persistence language ("ACTIVE ON EVERY RESPONSE" and "If unsure whether this applies: it applies") encourages the skill to remain active by default and resolve ambiguity in favor of continued control. This creates instruction stickiness that can override later context, interfere with other policies or skills, and make the agent harder to steer safely in mixed or evolving conversations.

Static analysis

No suspicious patterns detected.