ClawHub
Back to skill

Security audit

dgent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed developer cleanup tool for checking and optionally editing files or commit messages, with no artifact evidence of hidden or malicious behavior.

Install only if you want a CLI that can inspect project files and commit messages for AI-style patterns. Use the JSON or check modes first, and treat --fix or enabled git hooks as content-changing operations that should be reviewed in git before committing.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly instructs users to run `dgent run --fix <file>`, which writes changes back to the target file, but it does not clearly warn that user content will be modified in place. In an agent workflow, this can cause unintended edits or data loss, especially if run automatically or on the wrong file, making the lack of an explicit warning a real safety issue.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill says it 'Runs as git hooks automatically' and later that hooks will 'clean trailers and emoji automatically,' but it does not clearly disclose that commit-related content may be altered without an explicit confirmation step. Automatic modification of commit messages or staged content can surprise users, interfere with intent, and create integrity or workflow issues.

Static analysis

No suspicious patterns detected.