ClawHub
Back to skill

Security audit

Cross-Branch Migration Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill gives normal Convex project setup guidance with disclosed file creation and development commands, and I found no evidence of hidden or unrelated behavior.

Install this only if you want an agent to help set up or modify a Convex app. Expect it to create project files, install npm dependencies, and guide you through running Convex dev tools; review any chosen template or production deploy command before using it.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to create and save an HTML report under docs/ without clearly requiring user confirmation before writing files. In an agent context, implicit filesystem writes can modify the repository, create persistence artifacts, and surprise the user, especially when the report contains project-sensitive data gathered from git history.

Static analysis

No suspicious patterns detected.