ClawHub
Back to skill

Security audit

ClawMem Team

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only ClawMem team workflow skill whose state-changing behavior is disclosed, purpose-aligned, and gated by user approval.

Install this if you want ClawMem-based team setup and verification. Before approving bootstrap, ask the agent to show the exact repos, memory nodes, teams, grants, labels, agents, and seed issues it will create or reuse, especially in shared organizations or production repos.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Confirmations and next steps

- Name the next concrete decision the user must make, in their words.
- Do not ask the user to choose between internal status values; translate them.
- When mutation is needed, describe it in outcome terms first ("create a shared notebook for this team"), then name the tool, repo, or label only if the user asks for it.

## Output language
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.