ClawHub
Back to skill

Security audit

Ai Orchestration

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but users should keep its orchestration and logging behavior deliberately scoped.

Install if you intentionally want multi-agent orchestration support. Before use, decide what may be logged, avoid storing secrets or private transcripts, and prefer redacted or metadata-only logs unless full transcripts are truly needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The implicit activation criteria are broad enough to match many ordinary development tasks, which can cause the skill to activate outside its intended scope. In a skill with powerful tools and guidance for multi-agent delegation, overbroad triggering increases the chance of unnecessary context gathering, orchestration, or tool use on tasks that did not warrant this behavior.

Ssd 3

Medium
Confidence
93% confidence
Finding
The recommendation to 'Log all interactions' encourages indiscriminate retention of prompts, outputs, and possibly secrets, proprietary code, or personal data exchanged with agents. In an AI orchestration skill, centralized logging can aggregate sensitive data across multiple sub-agents, increasing exposure, retention, and compliance risk if logs are stored insecurely or kept longer than necessary.

Static analysis

No suspicious patterns detected.