ClawHub
Back to skill

Security audit

Gen Coding Specs

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed documentation-generation skill that writes bounded coding-spec Markdown files and does not show hidden execution, data theft, or destructive behavior.

Install only if you want this skill to inspect the current project and generate or update docs/coding-specs/. Review those generated files before committing them or letting other skills rely on them, and consider removing the broad “技术规范” trigger if accidental activation would be disruptive.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger pattern includes the generic phrase “技术规范”, which is broad enough to match ordinary discussion about technical standards rather than an intentional invocation of this skill. In an agent environment, ambiguous activation can cause the skill to run unexpectedly and write or overwrite files in docs/coding-specs/, creating integrity and workflow risks.

Vague Triggers

Medium
Confidence
95% confidence
Finding
Using the alias “技术规范” as a direct call phrase is overly vague and can collide with normal project conversations, making unintended skill execution plausible. Because this skill creates and overwrites a set of specification files consumed by downstream skills, accidental invocation can propagate incorrect guidance into later code generation or review steps.

Static analysis

No suspicious patterns detected.