ClawHub
Back to skill

Security audit

Capability Radar

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only skill that logs capability gaps to local memory so future sessions can improve workflows.

Install this only if you want the agent to write persistent capability-gap notes and let future sessions use them as improvement signals. Avoid recording secrets, private personal details, customer data, or sensitive operational context in those memory entries.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill defines several trigger conditions using broad natural-language concepts such as '做不了', '做错了', and '绕了一大圈才做到', which leaves substantial room for subjective interpretation. In a memory-writing workflow, this can cause over-triggering, noisy logging, and incorrect architectural signals that may drive unnecessary rule or skill changes.

Static analysis

No suspicious patterns detected.