ClawHub
Back to skill

Security audit

Code Quality Paid

Security checks for vulnerabilities and agentic risk

Overview

This skill is a code security audit guide that reads and scans project files, runs expected audit commands, and writes reports without evidence of hidden or malicious behavior.

Before installing, be aware that this skill is designed to inspect source code, run local audit commands, and generate security reports. Use it only on repositories you are authorized to scan, review CI artifact visibility and retention before enabling upload examples, and avoid putting real API keys directly into configuration files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
91% confidence
Finding
The skill explicitly instructs generation of multiple local report files under ./reports/ and other output paths, but it does not warn users that running it will modify the filesystem and leave potentially sensitive audit artifacts behind. In a security-audit context, those artifacts may contain vulnerability details, dependency findings, or project metadata, so silent file creation increases the risk of accidental disclosure or unsafe handling.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The CI/CD examples enable artifact generation and upload of SARIF and report directories without clearly warning that scan results may be transmitted to external CI/CD or code-hosting platforms. Because security scan outputs often contain sensitive vulnerability details, file paths, and code structure metadata, uploading them without explicit disclosure can leak internal security information beyond the local environment.

Static analysis

No suspicious patterns detected.