ClawHub
Back to skill

Security audit

加密文件

Security checks for vulnerabilities and agentic risk

Overview

This is a plainly described encryption helper that can change files and handle keys, but I found no hidden install code, persistence, or unrelated data access.

Install only if you intend to let the agent read and write the target files for encryption tasks. Before using it on important data, keep backups, confirm where encrypted output will be written, avoid overwriting originals unless intended, and do not provide API keys or encryption keys unless you understand where they will be used and stored.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill claims to perform file encryption and has access to exec/write tooling, but it does not prominently warn that encrypting files can overwrite data, alter originals, or make data unrecoverable if keys are mishandled. In an agent context, unclear destructive-side-effect disclosure increases the risk of accidental data loss, especially when users may assume a dry-run or reversible audit operation.

Static analysis

No suspicious patterns detected.