ClawHub
Back to skill

Security audit

Repo Mini Practice

Security checks for vulnerabilities and agentic risk

Overview

This skill is an instruction-only helper for creating a small learning project from a chosen repository, with no evidence of hidden or harmful behavior.

Install this if you want an agent to inspect a chosen repository and write a mini-practice/ learning directory. For private repos, review generated files before sharing or committing them; for untrusted repos, approve any run or test commands carefully.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill enables implicit invocation without defining any trigger constraints or exclusions, which can cause it to activate in broader contexts than intended. Because this skill is designed to inspect repositories and generate runnable mini versions, unintended activation could expose codebase contents to processing or cause the agent to perform repository-analysis actions when the user did not explicitly request this skill.

Static analysis

No suspicious patterns detected.