ClawHub
Back to skill

Security audit

专项测试

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed QA testing guide, with security-testing cautions that are mostly aligned to its stated purpose.

Before using this skill for security testing, confirm you own the target or have explicit written authorization, define the scope and environment, and treat the optional npx installation of the broader skill set as a separate trust decision.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The manifest lacks clear non-activation examples and boundary conditions, so the agent has less guidance on when not to invoke the skill. Because the skill covers penetration-style security testing and tool recommendations, missing boundaries increases the risk of overbroad use in ambiguous situations, though the in-body authorization warnings somewhat reduce the severity.

Vague Triggers

Low
Confidence
81% confidence
Finding
The manifest lacks clear non-activation examples and boundary conditions, so the agent has less guidance on when not to invoke the skill. Because the skill covers penetration-style security testing and tool recommendations, missing boundaries increases the risk of overbroad use in ambiguous situations, though the in-body authorization warnings somewhat reduce the severity.

Static analysis

No suspicious patterns detected.