ClawHub
Back to skill

Security audit

knowledge-base-publisher

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward documentation publishing skill that reads user-supplied content and creates organized output files, with no hidden executable behavior found.

Install only if you want an agent to read documentation from a chosen source folder and write organized knowledge-base files to a chosen target folder. Use a dedicated or staging output directory and review generated files before publishing them elsewhere.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs writing structured articles, metadata files, an index, and a changelog to an output directory, but it does not clearly warn the user that it will create and overwrite files during publication. In an agent setting, this can lead to unintended modification of local content, publishing to the wrong destination, or accidental exposure of sensitive documentation if the target path or platform is misconfigured.

Static analysis

No suspicious patterns detected.