ClawHub
Back to skill

Security audit

Vibe Sanitizer - Check and Sanitize git repository for secrets

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local repository secret scanner and sanitizer whose file access and optional edits match its stated purpose.

Install only if you want an agent to inspect repository contents for secrets and possibly rewrite or export sanitized files. Run scan first, use the narrowest scope, review output carefully, and only use in-place sanitization or export when you are comfortable with the resulting file changes.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to run bundled Python code, execute shell commands, and perform file reads and writes against an arbitrary repository, yet it declares no permissions. This creates a transparency and policy-enforcement gap: an operator or host system may treat the skill as lower-risk than it really is, while the actual workflow can modify files in place and access potentially sensitive repository contents.

Static analysis

No suspicious patterns detected.