ClawHub
Back to skill

Security audit

api-sequence-diagram

Security checks for vulnerabilities and agentic risk

Overview

This skill is an instruction-only helper for reading Java source code and producing API sequence diagrams, with no hidden execution or persistence behavior found.

Install this only for repositories where it is acceptable for the agent to read application source, mapper XML, and related call-chain code. Treat the generated business-logic interpretation as a review aid, not authoritative documentation, especially when the codebase contains sensitive implementation details.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description uses broad natural-language triggers such as analyzing interface call chains, generating sequence diagrams, and viewing API flow relationships. This can cause the skill to activate on loosely related user requests, potentially leading to unintended codebase inspection or disclosure of internal architecture when the user did not explicitly request this specialized behavior.

Static analysis

No suspicious patterns detected.