ClawHub
Back to skill

Security audit

Wuhao Writer - Popular Science

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a writing helper, but it includes optional third-party tool installation and automatic maintenance guidance that goes beyond normal article drafting.

Install only if you want a broad writing workflow, not just style prompts. Use the normal ClawHub or WorkBuddy install path, avoid the curl-to-bash command unless you independently inspect and trust it, and require explicit approval before invoking external research skills, syncing content to a knowledge base, or modifying local skill files.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill expands from style guidance into installation and use of external tools, creating a supply-chain and trust-boundary problem not justified by a writing-style skill. Users may be nudged to install or invoke third-party components under the skill's authority, increasing the chance of unreviewed code execution or data exposure.

Static analysis

No suspicious patterns detected.