ClawHub
Back to skill

Security audit

draw-skills

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only helper for drafting academic figure prompts, with minor activation-scope caveats but no code, credentials, persistence, or hidden access.

Install if you want an agent to help plan research-paper figures and write image-generation prompts. Use it intentionally for papers or images you are comfortable sharing with your agent runtime and any downstream image-generation service; consider narrowing activation to /draw-skills if your environment auto-triggers skills from broad keywords.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger keyword list is broad and includes common phrases such as 'generate figure', 'draw diagram', and multilingual generic terms that could match ordinary user requests outside the intended workflow. This can cause unintended skill activation, leading the agent to ingest unrelated user content or steer conversations into the skill's behavior when the user did not explicitly request it.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default analyze mode activates on 'Upload PDF / paste paper text', which is too ambiguous because many workflows involve PDFs or paper text without intending to invoke this skill. In an agent environment, such ambiguity can cause automatic processing of sensitive documents or context redirection without clear user consent.

Static analysis

No suspicious patterns detected.