ClawHub
Back to skill

Security audit

security-and-hardening

Security checks for vulnerabilities and agentic risk

Overview

This skill is a security-hardening guide with examples and checklists, and I found no evidence that it executes code, steals data, or changes the user's environment.

Before installing, expect this skill to provide Chinese-language security review guidance and code examples. Treat sample snippets as educational patterns to adapt carefully, especially around SSRF and secrets handling, but I found no evidence of unsafe automatic behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Hidden Instructions

High
Category
Prompt Injection
Content
---
name: security-and-hardening
version: 1.0.0
description: "Threat-model and harden applications against security vulnerabilities"
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Content
await fetch(await assertSafeUrl(req.body.webhookUrl), { redirect: 'error' });
```

`range() !== 'unicast'` 检查覆盖环回、链路本�?`169.254.169.254`（云元数据，#1 SSRF 目标）、私有和唯一本地范围�?IPv4 �?IPv6�?
**注意 �?这仍�?TOCTOU 缺口�?* `fetch` 在检查后再次解析 DNS，所以使用短 TTL 记录的攻击者可以在验证和连接之间重绑定到内�?IP。对于高风险面，解析一次并连接到固�?IP，或在前端放置过滤代理�?
---
Confidence
90% confidence
Finding
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Credential Access

High
Category
Privilege Escalation
Content
## Secrets Management

```
.env files:
  ├── .env.example  �?Committed (template with placeholder values)
  ├── .env          �?NOT committed (contains real secrets)
  └── .env.local    �?NOT committed (local overrides)
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Secrets Management

```
.env files:
  ├── .env.example  �?Committed (template with placeholder values)
  ├── .env          �?NOT committed (contains real secrets)
  └── .env.local    �?NOT committed (local overrides)
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Secrets Management

```
.env files:
  ├── .env.example  �?Committed (template with placeholder values)
  ├── .env          �?NOT committed (contains real secrets)
  └── .env.local    �?NOT committed (local overrides)
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
.env files:
  ├── .env.example  �?Committed (template with placeholder values)
  ├── .env          �?NOT committed (contains real secrets)
  └── .env.local    �?NOT committed (local overrides)

.gitignore must include:
  .env
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
.env files:
  ├── .env.example  �?Committed (template with placeholder values)
  ├── .env          �?NOT committed (contains real secrets)
  └── .env.local    �?NOT committed (local overrides)

.gitignore must include:
  .env
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
This markdown skill description presents its operational guidance in Chinese, despite the skill name and metadata being otherwise language-neutral and without any opt-in, language selection, or region-specific justification. That creates a natural-language policy issue because it imposes a specific locale on users by default.

Static analysis

No suspicious patterns detected.