ClawHub
Back to skill

Security audit

Code 1 0 4

Security checks for vulnerabilities and agentic risk

Overview

This is a broad coding-helper skill with expected read and command-execution authority, but no hidden persistence, exfiltration, or destructive behavior in the artifact.

Before installing, treat this as a general coding skill that may read project files and run shell commands when used. Review commands before execution, be careful with deployment tasks, and do not place real API keys in project files or chat unless needed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill advertises itself for very broad coding, debugging, testing, and deployment use without clearly constraining when it should be invoked or what actions require explicit user confirmation. In an agent environment, this can cause overbroad routing and unintended activation for sensitive development tasks, increasing the chance of unsafe code execution or inappropriate tool use.

Natural-Language Policy Violations

Medium
Confidence
77% confidence
Finding
The description mixes English and Chinese instructions and states Chinese usage guidance without declaring a locale requirement or offering language selection. This can cause users or downstream agents to misunderstand operating constraints, leading to incorrect invocation, missed safety expectations, or improper handling of sensitive actions.

Static analysis

No suspicious patterns detected.