ClawHub
Back to skill

Security audit

Playbook Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guided YAML playbook generator, with only a limited local file creation behavior to be aware of.

Before installing, understand that the skill may create or update a YAML file under playbooks/imported. Review the generated YAML before importing it into the platform, use a simple kebab-case playbook_id, and choose the display/copy-paste option if you do not want the agent to write a local file.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly instructs the agent to write generated YAML to a local path (`playbooks/imported/{playbook_id}.yaml`) without requiring an explicit user confirmation or warning that local files may be modified. In an agentic environment with filesystem tools, this can lead to unintended local state changes or unsafe file creation based on user-controlled identifiers, especially if the agent defaults to writing rather than only displaying output.

Static analysis

No suspicious patterns detected.