ClawHub
Back to skill

Security audit

ai-tool-research

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed research-and-report-writing skill that creates Markdown reports and a run log, with no evidence of hidden execution, credential use, or destructive behavior.

Install this only where you are comfortable letting an agent perform web research and create or update Markdown reports. Choose a specific output directory, use append mode if preserving existing report bodies matters, and review generated third-party install recommendations before running them.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill directs the agent to write and append multiple files in a user-specified or default current working directory, but it does not require explicit confirmation before modifying the filesystem. In agent runtimes with file access, this can lead to unintended overwrites, clutter, or corruption of existing documentation if the output directory is broad, ambiguous, or attacker-influenced.

Static analysis

No suspicious patterns detected.