ClawHub
Back to skill

Security audit

Repo Mini Practice

Security checks for vulnerabilities and agentic risk

Overview

This skill creates a small runnable learning project inside a repository, and its file-writing and documentation behavior is disclosed and scoped to that purpose.

Install this if you want an agent to read a repository and add a mini-practice/ learning project. Be aware it may generate bilingual Chinese and English README content by default, so ask for a single language if you want less output or are working with private material.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Defaulting to bilingual Chinese and English output without explicit user opt-in can cause unintended disclosure or policy mismatch in environments with strict language, minimal disclosure, or data-handling expectations. It also increases output surface area, which can amplify accidental reproduction of sensitive repository details into an additional language the user did not request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Requiring both Chinese and English README sections by default overrides user preference and may duplicate sensitive implementation details unnecessarily. In a repository-learning workflow, this increases the amount of transformed content generated from the source and can widen exposure if the repository contains proprietary logic or internal conventions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The enforced bilingual README structure creates the same unnecessary duplication risk at the documentation-policy level and makes the behavior mandatory rather than situational. This is more concerning because it is framed as a requirement, reducing the agent's ability to minimize disclosure or honor least-necessary output practices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Making a bilingual README part of the quality bar institutionalizes unnecessary content expansion across all uses of the skill. In context, this is not malicious, but it increases the chance of over-sharing repository-derived details and conflicts with principle-of-minimization in user-directed code analysis and reconstruction tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The default prompt is broad enough to match many ordinary repository-learning requests, which can cause this skill to be invoked implicitly in situations beyond the user's explicit intent. Because the skill creates runnable mini versions of repositories, overbroad triggering increases the chance of unnecessary code transformation or analysis on sensitive or untrusted codebases.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description says to use the skill when a user wants to 'learn a GitHub or local codebase' or 'understanding its implementation principles,' which is broad and could match many ordinary repository-help requests. It does not provide narrow trigger phrases or negative examples in the manifest itself to clearly separate this skill from general code explanation or review tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.