ClawHub
Back to skill

Security audit

Security Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a simple security-scanning instruction skill that is dual-use but disclosed and purpose-aligned, with no hidden code, persistence, or credential handling.

Install only if you intend to use it for systems you own or are explicitly authorized to test. Before running the example scans, define the exact target scope, get permission, and use conservative scan settings for fragile or production systems.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Content
applications, APIs, and infrastructure. Use when you need to scan targets for vulnerabilities, check SSL certificates, find open ports, detect misconfigurations, or perform security audits. Integrates with nmap, nuclei, and other security tools.
---

# Security Scanner

Automated security scanning toolkit for penetration testing and vulnerability assessment.

## Quick Start

### Port Scan
```bash
nmap -sV -sC -oN scan.txt TARGET
```

### Vulnerability Scan
```bash
nuclei -u TARGET -o results.txt
```

### SSL Check
```bash
sslscan TARGET
```

## Scan Types

### 1. Quick Recon
Fast initial scan for live hosts and open ports:
```bash
nmap -sn -T4 SUBNET  # Host discovery
nmap -F TARGET       # Fast port scan (top 100)
```

### 2. Full Port Scan
Comprehensive port and service detection:
```bash
nmap -p- -sV -sC -A TARGET -oN full_scan.txt
```

### 3. Web Application Scan
```bash
nuclei -u https://TARGET -t cves/ -t vulnerabilities/ -o web_vulns.txt
nikto -h TARGET -o nikto_report.txt
```
Confidence
70% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description uses very broad activation criteria such as scanning for vulnerabilities, open ports, and security audits without sufficiently constraining use to explicit authorization or defensive contexts. In an agent setting, this can cause the skill to be invoked for ambiguous or potentially unauthorized targets, enabling active reconnaissance against third parties.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill provides active scanning commands across the document but does not place a prominent upfront warning that these actions generate network traffic, may trigger monitoring, and can disrupt fragile services. In practice, an agent or user could run aggressive probes like service detection, NSE scripts, or full-port scans without appreciating the operational and legal consequences.

Static analysis

No suspicious patterns detected.