ClawHub
Back to skill

Security audit

Code Security Review

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed code security review skill that reads user-provided code to report vulnerabilities and does not include hidden execution, persistence, or data exfiltration behavior.

Install this only if you want an agent to inspect code for vulnerabilities. Use explicit paths or pasted snippets when invoking it, and avoid pointing it at repositories containing secrets unless you are comfortable with the active agent processing that content.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions are broad enough to match ordinary security-related requests such as PR reviews or generic 'security review' prompts. In agent environments with automatic skill routing, this can cause unintended invocation, expanding the skill’s influence over user workflows and increasing the chance of prompt collisions, incorrect tool use, or accidental processing of sensitive repositories.

Static analysis

No suspicious patterns detected.