ClawHub
Back to skill

Security audit

Wechat Article Html

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Markdown-to-WeChat-HTML formatter with only a minor file-output caution.

Install if you want automatic WeChat-compatible HTML formatting from Markdown. Before running it, confirm which Markdown file it will read, where the *_for_paste.html file will be written, and whether any existing output file could be overwritten.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly instructs the agent to write a `*_for_paste.html` output file but does not specify any confirmation, safe destination, or overwrite protection. This can lead to unintended file creation or overwriting of an existing file in the user's workspace, especially in automated agent flows where file writes may occur without clear user awareness.

Static analysis

No suspicious patterns detected.