Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed ClawHub lifecycle audit playbook with manual publish/update commands, not hidden or automatic malicious behavior.
Install only if you want a ClawHub skill lifecycle playbook tailored to this workflow. Treat clawhub publish and clawhub update as manual approval points because they can change public registry state or local installed skills, and review the hardcoded paths, owner names, and AEST schedule before using it in another environment.
The skill is described as audit-focused, but the documented workflow includes state-changing operations such as running a publish gate and publishing skill updates. That expands the capability from inspection into modification of external registry state, increasing the risk that an agent or user invokes unintended release actions under the guise of an audit.
The guidance to run clawhub update <slug> introduces a modification capability not reflected in the skill's stated audit-only purpose. Even though this is documented as a follow-up action, it can cause local environment changes and blur the boundary between assessment and remediation, which is unsafe for an auditing skill.
The 'When to use' section specifies a fixed schedule of 'Monday 09:00 AEST', which embeds a locale/timezone assumption in the skill guidance. The file does not indicate that this timezone is optional, configurable, or justified as a region-specific constraint, so it can conflict with users outside that locale.
No suspicious patterns detected.
