ClawHub
Back to skill

Security audit

Skillet Skillify

Security checks for vulnerabilities and agentic risk

Overview

This is a simple skill-writing guide whose behavior matches its purpose and does not contain hidden execution, network access, or credential handling.

Install this if you want help formalizing repeated workflows into reusable skills. Review generated skills before installing or publishing them, especially if the source procedure includes private paths, credentials, client names, or sensitive operational details.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description uses broad trigger phrases like "make this a skill" and "I keep doing this manually," which are common conversational expressions and may cause the skill to be invoked in situations where the user did not intend skill extraction. In an agent system that auto-selects skills from descriptions, this can lead to inappropriate activation, workflow drift, or accidental generation of persistent reusable artifacts from sensitive or one-off tasks.

Static analysis

No suspicious patterns detected.