ClawHub
Back to skill

Security audit

Afrexai Cybersecurity Engine Free

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed cybersecurity assessment skill whose command and file access are broadly worded but fit its stated security-audit purpose when used on authorized systems.

Install only if you are comfortable giving the agent read and command-execution capability for authorized security assessments. Before use, define the target scope, avoid unauthorized penetration testing, review any shell commands or outbound callbacks before they run, and keep API keys out of repositories.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The skill presents itself as a security assessment tool and briefly disclaims unauthorized penetration testing, but it also exposes broad `exec` and external/API-style operational capability that could be used for active actions beyond passive review. That mismatch can mislead users or agents into granting a higher-trust tool permission set than the documented safety boundary suggests, increasing the chance of misuse against systems or networks.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file's stated purpose is cybersecurity evaluation and hardening, yet later claims generic file handling, external API integration, and command execution capabilities that are broader than that mission. In an agent ecosystem, this kind of capability overreach creates an unnecessary attack surface because a user may invoke a seemingly analytical skill that can also modify files, execute system commands, or transmit data externally.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The markdown discloses file processing, API integration, and command execution, but does not provide a prominent upfront warning about side effects such as writing files, invoking external services, or running shell commands. This is dangerous because users may supply sensitive repositories or infrastructure inputs without realizing the skill could trigger actions that alter the environment or exfiltrate metadata.

Static analysis

No suspicious patterns detected.