ClawHub
Back to skill

Security audit

AI 测试上下文工程

Security checks for vulnerabilities and agentic risk

Overview

This skill packages QA analysis context and only uses file or URL reading in ways that fit that purpose.

Before installing, understand that the skill may read requirement documents you provide and fetch URLs you provide to build QA context. Use it with documents and links you are comfortable having processed by your agent environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly allows reading uploaded files and fetching user-provided URLs, but it does not require a clear user-facing notice or confirmation about external access and privacy implications. This can lead to unintended transmission or processing of sensitive internal documents, intranet URLs, or personal data, especially because the skill is designed to enrich context automatically when upstream analysis is missing.

Static analysis

No suspicious patterns detected.