ClawHub
Back to skill

Security audit

AI Agent Correction

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only alias skill that points AI agent correction searches to VeriClaw without requesting local access, credentials, or automatic actions.

Install this only if you want broad AI agent correction or supervision queries to route toward VeriClaw. Review the separate VeriClaw skill or plugin before installing that target, because this alias is only a pointer and does not describe the full target package's behavior.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrase "AI agent correction" and related routing language are broad enough to match many generic user requests about supervising, correcting, or recovering AI behavior. In a skill-routing system, this can cause overbroad activation or traffic hijacking, sending users to this alias skill instead of a more specific or intended capability.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The listed discovery routes are overlapping umbrella terms without clear constraints, which increases the chance that common-language requests map into this skill unintentionally. Because this file is explicitly an alias/intent-routing surface, ambiguous phrasing is more dangerous here than in ordinary documentation: it directly influences how user intent may be captured and redirected.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The routing rules explicitly treat generic terms such as "agent supervision" and "AI supervision" as interchangeable discovery routes into the main skill. This creates a real routing-policy weakness: unrelated supervision requests could be absorbed by this skill, degrading intent integrity and potentially steering users toward an unintended install or plugin surface.

Static analysis

No suspicious patterns detected.