claudify

• Outcome: Review
• Latest audit: Aug 13, 2026 · 7:15 AM UTC
• Version: 0.5.4

Overview

This skill is mostly a disclosed automation-building guide, but it includes automatic long-term storage of session/project knowledge without clear per-item user consent.

Install only if you want a skill that can help create or modify Claude automations. Before using /claudify persist or cleanup flows, review what will be saved and where; avoid storing secrets, credential locations, personal data, or project-private details without explicit approval. Prefer project-local automations first, and inspect generated hooks carefully, especially logging, auto-stage, and build hooks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description contains very broad trigger phrases such as 'automate this', 'make a plugin', and 'self-improve', which can cause the skill to activate on ordinary user requests unrelated to this specific capability. In an agentic environment, overbroad invocation increases the chance the skill is selected in the wrong context and then performs file creation, modification, or automation-related actions the user did not specifically intend.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs saving session-discovered knowledge to persistent memory and describes automatic behavior during cleanup, but it does not require a clear user-facing retention notice or explicit confirmation before persistence. This creates a real privacy and data-governance risk because users may disclose sensitive project, infrastructure, or personal workflow details that are then retained beyond the session without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented fallback to Claude Code auto memory writes to project-local files such as memory/MEMORY.md and related .md files, but the skill does not prominently warn that local repository files may be created or modified. In an agentic automation context, silent local writes can leak sensitive operational context into tracked files, surprise users, and cause unintended persistence or source-control exposure.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The template encourages authors to write vague trigger conditions such as 'Use when [trigger conditions]' without requiring narrow activation boundaries, exclusions, or authority checks. In an agentic system, overly broad routing criteria can cause accidental invocation of powerful agents in unrelated contexts, increasing the chance of unsafe tool use or unintended automation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description template permits generic trigger keywords without constraining scope or providing non-trigger examples, which makes prompt-based agent selection easier to manipulate or misfire. In this skill's context, where templates are used to create reusable automation agents, ambiguous activation rules can propagate unsafe invocation patterns across many downstream agents.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The logging example records tool usage and affected file paths into a persistent log file without any warning about privacy, retention, or redaction. In an agent environment, file paths and tool activity can reveal repository names, usernames, project structure, and potentially sensitive operational behavior, making silent collection risky if users adopt the example as-is.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The auto-stage example performs `git add` automatically after edits, which can cause unintended files to be staged without user review. In practice this can lead to accidental inclusion of secrets, generated files, or unrelated modifications, especially because hook execution is implicit and frequent.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

|---|-------|-----|
| 1 | Read `resources/agent-templates.md` (358 lines) + `automation-decision-guide.md` + `askuserquestion-patterns.md` inline before creating one agent | Dispatch general-purpose subagent: "Read these 3 templates and create agent at `<path>` with name=X, tools=Y, description=Z. Return the created file path only." |
| 2 | Inline scan transcript for candidates by Read-ing the full session JSONL | Dispatch Explore subagent: "Find verbose tool-output patterns (>500 tokens repeated 2+ times) in conversation. Return candidate list (label + 1-line description) under 200 words." |
| 3 | Inline Glob + Read all marketplace plugin SKILL.md files | Bash 1-liner: `find ~/.claude/plugins/marketplaces/*/plugins/*/ -name SKILL.md -exec head -3 {} \;` returns names without body |
| 4 | "Just one more Read" cumulative inline reading | Quantify: if next operation expected to add >2K tokens to parent context AND result is not the deliverable itself, dispatch subagent |
| 5 | Dispatch subagent with vague prompt ("create the agent") | Subagent prompt must include: target file path, name, tools, model, description (single-line YAML), trigger keywords. Return only the file path |

• Confidence: 88% confidence
• Finding: find ~/.claude/

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

"hooks": [
          {
            "type": "command",
            "command": "if [ -f /tmp/changed-packages ]; then sort -u /tmp/changed-packages | xargs -I{} pnpm --filter {} build && rm /tmp/changed-packages; fi"
          }
        ]
      }

• Confidence: 72% confidence
• Finding: rm /tmp/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.