ClawHub
Back to skill

Security audit

servicepack

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent guide for using a Go template framework, with its destructive clone-renaming step disclosed and aligned with the template workflow.

Install only if you intend to start from a fresh servicepack clone. Treat `make own` as destructive for that clone: run it only after confirming you are in the intended repository and have no local history or work there that you need to keep.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation instructs users to run an irreversible `make own` process that deletes `.git`, reinitializes the repository, rewrites imports, and replaces files, but it does not give an explicit precaution to ensure the clone is disposable or that any local work is backed up first. In a setup guide for a clone-and-own framework, users may reasonably execute these commands quickly, and the lack of a prominent data-loss warning increases the chance of accidental destruction of local history or uncommitted changes.

Static analysis

No suspicious patterns detected.