ClawHub
Back to skill

Security audit

EasyClass Auto-Improve

Security checks for vulnerabilities and agentic risk

Overview

This skill is an automated coding workflow, but its default workflow can discard local code changes without a clear confirmation step.

Install only if you are comfortable with an agent making unattended repository changes. Before use, remove or gate the `git reset --hard` step, require a clean working tree or backup branch, and keep scheduled runs limited to disposable or well-backed-up repositories.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

High
Confidence
97% confidence
Finding
The workflow explicitly instructs a forced sync using `git fetch + reset --hard + pull`, which can irreversibly discard local uncommitted changes. In an automated skill that runs on a schedule and performs code modifications, this is dangerous because it can cause silent data loss and destroy in-progress work without any explicit warning, confirmation, or backup step.

Static analysis

No suspicious patterns detected.