ClawHub
Back to skill

Security audit

假完成诊断

Security checks for vulnerabilities and agentic risk

Overview

The skill content is mostly coherent maintainer guidance, but one bundled review helper grants broad local execution authority by default.

Install only if you trust the ClawHub maintainer workflow and are comfortable with repo-local commands that can post/publish, moderate accounts, run migrations, and invoke a full-access nested review helper. Prefer using the helper's no-yolo option and review exact commands before running moderation, publishing, deployment, or migration steps.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.