ClawHub
Back to skill

Security audit

harness

Security checks for vulnerabilities and agentic risk

Overview

This skill is a workflow harness that adds planning, guardrails, and bounded recovery behavior for agents, with no executable code or hidden data handling found.

Install this if you want an agent workflow wrapper that enforces planning, scoping, guardrails, and recovery. In autonomous or headless use, configure your runtime so package installs, version pinning, and permission changes require explicit policy approval or are limited to a known safe environment.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The recovery guidance explicitly recommends applying environment fixes such as installs, version pinning, or permission changes, but it does not require an explicit user warning or confirmation before making system-impacting changes. In a headless autonomous recovery flow, this can lead to unintended modification of the runtime environment, which increases operational and security risk even if the intent is legitimate resilience.

Static analysis

No suspicious patterns detected.