ClawHub
Back to skill

Security audit

fore-vip-ds-harness

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local setup helper for DeepSeek Harness, but it will install software, change npm settings, and add a desktop launcher.

Install only if you want the agent to modify your local development environment. Before running it, ask for a dry-run summary of the exact commands, confirm whether changing the npm registry is acceptable, and prefer the npx option if you do not want a global install or persistent desktop launcher.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill directs the agent to generate and execute local scripts, install software, modify npm configuration, and create desktop launchers without an explicit confirmation checkpoint immediately before each state-changing action. In an agentic environment, this materially increases the risk of unintended system modification, persistence-like artifacts, and user surprise, especially if the skill is triggered from a vague setup request.

Static analysis

No suspicious patterns detected.