Security audit
Pact Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill set is mostly transparent and purpose-aligned, but one review helper defaults to running a nested Codex review with full sandbox bypass, which is more authority than a code-review workflow normally needs.
Install only if you need ClawHub maintainer or Convex development workflows and you trust the repository context. Use the moderation and publishing skills only with the intended authenticated accounts, review exact commands before writes, and prefer `--no-yolo` or `AUTOREVIEW_YOLO=0` when using the autoreview helper unless full sandbox bypass is truly acceptable.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.