ClawHub
Back to skill

Security audit

Skill Auditor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent audit helper that reads skill files, writes audit reports, and only edits target files after user confirmation.

Before installing, understand that normal audits write report files into the target skill directory, and remediation/originality cleanup can modify target skill files after confirmation. Use it on repositories where those local report files and optional edits are acceptable, and keep version control or backups for audited skills.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The README states that audit reports are written to <skill-dir>/.audit-report.md and .audit-report-prev.md, but it does not clearly warn that normal use will create or overwrite files in the target skill directory. In a security-auditing context, unexpected filesystem writes can surprise users, destroy prior reports, or modify repositories that were assumed to be read-only, which is especially risky because the skill otherwise emphasizes a mostly read-only audit workflow.

Static analysis

No suspicious patterns detected.