Security audit
Sanna Governance
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed governance wrapper that controls tool calls and records receipts, with no evidence of hidden or destructive behavior in the reviewed artifact.
Before installing, understand that this skill is meant to let the Sanna plugin mediate tool calls and persist audit receipts. Review the required @sanna-ai/openclaw plugin and its constitution settings, because that external plugin determines the actual enforcement behavior.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.