ClawHub
Back to skill

Security audit

Danish

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Danish writing-style skill with no code, tools, data access, persistence, or hidden behavior.

Install this if you want Danish responses to sound more casual and native-like. Ask explicitly for formal, neutral, or business Danish when that register matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The skill is explicitly scoped to producing Danish and the description directs the model to write in a particular Danish style as a default. Because the instructions do not mention user choice or opt-in, this creates a language/locale policy concern under the rule for forced language behavior.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The file states that the default register should lean casual and gives explicit replacements like using "Hej" instead of "Goddag." This forces a locale-specific tone choice without indicating that the user can request a different register, which may violate language/locale policy expectations.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The section says "Du" should be used for everyone, always, and dismisses formal address as essentially dead. This is a blanket locale rule that overrides potential user or context preferences and lacks any opt-in or exception path, making it a natural-language policy issue.

Static analysis

No suspicious patterns detected.