ClawHub
Back to skill

Security audit

self-improving-security

Security checks across malware telemetry and agentic risk

Overview

This skill is a security-learning logger with opt-in reminder hooks and clear redaction guidance, with only minor documentation cautions.

Install this only if you want a local security findings log. Keep hooks project-scoped, prefer the activator-only hook, avoid the optional command-output detector in sensitive environments unless needed, and redact secrets or PII before anything is written to .learnings.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
78% confidence
Finding
The skill defines broad automatic detection and hook matchers for terms like "security", "auth", "secret", and "compliance", which can trigger on ordinary discussion and command output. In a security-logging skill, that increases the chance of over-collection of sensitive context, unnecessary activation, and accidental persistence of incident details when the user did not intend logging behavior.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Test Error Detector Hook

1. Enable PostToolUse hook for Bash
2. Run a command that produces security-relevant output: `curl -k https://expired.badssl.com/`
3. Verify you see `<security-finding-detected>` reminder

### Dry Run Extract Script
Confidence
88% confidence
Finding
The guide recommends testing with `curl -k`, which disables TLS certificate validation. Even though it targets an intentionally expired-cert test site, normalizing insecure flags in setup documentation can train users to bypass transport security checks and may be copied into real workflows against non-test endpoints.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.