ClawHub
Back to skill

Security audit

可测试性倡导

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only QA guidance skill for evaluating software testability, with no evidence of hidden execution, data exfiltration, or destructive behavior.

Before installing, be aware that the skill may activate for broad architecture or testing-improvement requests and may inspect repository materials to produce advice. It should be used for testability reviews, and any suggested data cleanup or architectural changes should be confirmed manually before acting on them.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation guidance uses broad natural-language triggers such as '架构改进' and '测试推动', which can cause the skill to be invoked in situations beyond narrow testability assessment. Unintended invocation can steer an agent into producing structured testing and refactoring guidance when the user asked for something adjacent, increasing the risk of irrelevant actions, scope creep, or accidental disclosure of repository/architecture details during analysis.

Static analysis

No suspicious patterns detected.