ClawHub
Back to skill

Security audit

技能升级巧匠L2

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only skill for improving other AI skill definitions, with no hidden code execution, credential handling, or data exfiltration behavior found.

Before installing, consider narrowing the broadest triggers if your environment has many authoring or debugging skills, so this one only activates for existing Skill upgrade and multi-skill routing tasks.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill is designed for routing, and broad trigger phrases can cause unintended activation, especially in a multi-skill environment where dispatch is based on loose natural-language matching. This can let the skill preempt more appropriate skills, leading to misrouting, workflow interference, and reduced reliability of downstream actions.

Vague Triggers

Medium
Confidence
94% confidence
Finding
Several listed triggers are ambiguous operational phrases like fixing entry points, division of labor, or frontmatter completion, which may overlap with many unrelated authoring or debugging skills. In a skill group, these overlaps increase collision risk and can cause the wrong skill to claim requests, degrading task isolation and making agent behavior unpredictable.

Static analysis

No suspicious patterns detected.