ClawHub
Back to skill

Security audit

FOSMVVM ViewModel Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only generator skill for Swift ViewModel scaffolding, with no hidden execution or persistence behavior found.

Before installing, expect this skill to help create Swift source and localization YAML files in your project. Review generated filenames, targets, and locales to ensure they match your app, especially if you need non-English localization.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The localization examples and templates consistently define only an `en:` root and present English strings as the default pattern for generated skill artifacts. Because this markdown file is guidance material, that natural-language instruction can steer users toward English-only output without any opt-in or mention of multilingual support, which conflicts with the locale-choice policy.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
This example YAML defines only `en:` entries for `SettingsViewModel` and does not indicate that other locales may or should be used based on user needs. In instructional material, such one-language examples can effectively impose an English-only convention unless the document explicitly frames them as optional examples.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The Dashboard localization example uses only an `en:` block and gives no indication that locale is configurable or should follow user requirements. Since SQP-3 applies to natural-language examples as well as prose, this is a policy concern in the instructional content.

Static analysis

No suspicious patterns detected.