ClawHub
Back to skill

Security audit

RedHat Code Generation

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward code-generation instruction skill with a malformed trigger field but no evidence of hidden execution, credential access, persistence, or unrelated behavior.

Before installing, note that the trigger metadata should be fixed so activation is clearer. Treat generated code like any other code contribution: review changes, run the suggested validation commands, and avoid putting secrets into specs or generated files.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
96% confidence
Finding
This manifest file appears to define triggers, but the value shown is just a generic placeholder-like entry (`System.Object[]`) rather than an explicit list of invocation phrases or conditions. Without concrete trigger phrases, scope limits, or exclusion conditions, the skill's activation behavior is unclear and could lead to unintended invocation.

Static analysis

No suspicious patterns detected.