ClawHub
Back to skill

Security audit

Steal List

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a disclosed research/scouting helper that may inspect a project and save a local report, with no evidence of deception or harmful behavior.

Install this if you want an agent to research examples and save scouting notes into your workspace. Before using it in confidential repositories, confirm you are comfortable with repository inspection, web research, and creation of .scout report files.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill is designed to be suggested proactively using broad phrases like 'show me examples' or 'what's out there,' which can match many normal conversations and trigger unnecessary web access and repository analysis. In an agent setting, overly broad activation increases the chance of unexpected tool use and side effects, especially since this skill can later write files and invoke external tooling.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to create a `.scout/` directory and write a timestamped report in the project root without an explicit user-facing warning at the point of modification. Even though the file is a research artifact, silent workspace writes can surprise users, overwrite expectations about read-only analysis, and become more risky when the skill is triggered too easily or used in sensitive repositories.

Static analysis

No suspicious patterns detected.