ClawHub
Back to skill

Security audit

Security Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a simple security-scanning instruction skill that is dual-use but disclosed and purpose-aligned, with no hidden code, persistence, or credential handling.

Install only if you intend to use it for systems you own or are explicitly authorized to test. Before running the example scans, define the exact target scope, get permission, and use conservative scan settings for fragile or production systems.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

applications, APIs, and infrastructure. Use when you need to scan targets for vulnerabilities, check SSL certificates, find open ports, detect misconfigurations, or perform security audits. Integrates with nmap, nuclei, and other security tools.

Security Scanner

Automated security scanning toolkit for penetration testing and vulnerability assessment.

Quick Start

Port Scan

bash
nmap -sV -sC -oN scan.txt TARGET

Vulnerability Scan

bash
nuclei -u TARGET -o results.txt

SSL Check

bash
sslscan TARGET

Scan Types

1. Quick Recon

Fast initial scan for live hosts and open ports:

bash
nmap -sn -T4 SUBNET  # Host discovery
nmap -F TARGET       # Fast port scan (top 100)

2. Full Port Scan

Comprehensive port and service detection:

bash
nmap -p- -sV -sC -A TARGET -oN full_scan.txt

3. Web Application Scan

bash
nuclei -u https://TARGET -t cves/ -t vulnerabilities/ -o web_vulns.txt
nikto -h TARGET -o nikto_report.txt

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description uses very broad activation criteria such as scanning for vulnerabilities, open ports, and security audits without sufficiently constraining use to explicit authorization or defensive contexts. In an agent setting, this can cause the skill to be invoked for ambiguous or potentially unauthorized targets, enabling active reconnaissance against third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill provides active scanning commands across the document but does not place a prominent upfront warning that these actions generate network traffic, may trigger monitoring, and can disrupt fragile services. In practice, an agent or user could run aggressive probes like service detection, NSE scripts, or full-port scans without appreciating the operational and legal consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.