ClawHub
Back to skill

Security audit

Prompt Craft

Security checks for vulnerabilities and agentic risk

Overview

This skill is a prompt-design guide that may create SKILL.md files as part of its stated purpose, with no hidden code, credential use, network access, or persistence.

Install this if you want a structured guide for designing prompts, skills, and agent workflows. Before using it to generate files, confirm the target path and review the final SKILL.md because the workflow expects a completed file to be written.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The integration guidance uses broad natural-language trigger phrases like creating a skill, optimizing prompts, designing agents, or orchestration, which can cause the agent to invoke this skill in situations where the user's intent is ambiguous. In a prompt-design skill, unintended activation is risky because it can redirect execution flow, override a more appropriate specialist skill, and lead to unreviewed prompt or agent-architecture changes.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The workflow states that the final SKILL.md is written to disk as a completion condition, but it does not require explicit user consent or a user-facing warning before modifying files. This creates a real risk of unintended file system changes, especially if the skill is auto-invoked or used in environments where writing artifacts is sensitive.

Static analysis

No suspicious patterns detected.