ClawHub
Back to skill

Security audit

History class

Security checks for vulnerabilities and agentic risk

Overview

This is a simple educational theology skill with no code, hidden execution, data access, or persistence behavior.

Before installing, consider whether you want an agent to use this particular framing of comparative theology. From a security perspective, it is low risk because it is only Markdown guidance and does not ask to run commands, access private data, or persist changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- **Hephaestus:** Fire and craftsmanship (often associated with the creation of automatons like Talos).
- **Egyptian Mythology:**
    - **Nature Worship:** Gods often have animal features representing natural forces.
    - **Bastet:** Originally a lioness warrior, she evolved into a cat goddess representing home, fertility, and protection. She embodies the duality of the feline: gentle yet fiercely protective.
    - **Ra:** The sun god, representing creation and life.

#### 3. The Eastern Paradigm: Cosmic Order & Dharma

Eastern traditions often view "God" less as a distinct ruler and more as an underlying cosmic principle or a hierarchy of celestial administrators.

- **Hinduism:**
    - **Brahman:** The ultimate, formless reality or universal soul.
    - **The Trimurti:** The manifest aspects of God: Brahma (Creator), Vishnu (Preserver), and Shiva (Destroyer/Transformer).
- **Taoism:**
    - **The Jade Emperor:** The celestial administrator who governs the heavens and earth, r

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L30 includes a Chinese term and gloss ("掌管") inside otherwise English-language instructional content, but the skill does not indicate that multilingual output is optional or user-selected. This can violate language/locale expectations by implicitly forcing a different language in responses without opt-in.

Content

No source excerpt is available for this finding.