ClawHub
Back to skill

Security audit

Mise

Security checks for vulnerabilities and agentic risk

Overview

This is a planning-only skill that enforces writing and approving a design spec before implementation, with no evidence of hidden execution, credential use, or data exfiltration.

Install this if you want a strict design-first workflow for build work. Be aware it may slow small tasks by requiring a design, a docs/specs file, user review, and a commit before implementation; review those generated specs before allowing follow-on build work.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description contains very broad trigger language such as 'before any creative or build work' and 'let's build X,' which can cause the agent to invoke this skill for a wide range of ordinary requests. Overly broad activation increases the chance of unintended interception of user tasks, unnecessary workflow enforcement, and chaining into other skills without clear user intent.

Static analysis

No suspicious patterns detected.