ClawHub
Back to skill

Security audit

Exec Truncate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed output-truncation utility for shell command results, with review cautions but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you are comfortable with shell output being shortened before the agent reasons over it. For audits, incident response, destructive operations, or commands that may emit secrets, review raw unfiltered output before acting. If installing from a plugin package outside this artifact, confirm the manifest and hook files match the documented behavior.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README markets aggressive truncation of exec output as a benefit but does not clearly warn that the plugin can suppress security-relevant context, such as omitted error details, hidden diff hunks, or truncated grep/build results. In an agent setting, users may over-trust the summarized output and make unsafe decisions because they are unaware that critical lines may have been removed.

Static analysis

No suspicious patterns detected.