ClawHub
Back to skill

Security audit

Java代码

Security checks for vulnerabilities and agentic risk

Overview

This Java code review skill appears non-malicious, but it asks for broad command and file authority while its routing language extends beyond code review into general development and deployment tasks.

Review before installing. Use this only when you explicitly want Java code review or report generation, and avoid letting it run broad development, deployment, Git, or file-modifying workflows unless you have confirmed the exact commands and outputs.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill description uses overly broad trigger language covering generic development, debugging, deployment, and code generation scenarios, which can cause the agent to invoke this skill in contexts beyond narrow code review. Because the skill has read, write, and exec tools, overbroad routing increases the chance of unnecessary command execution or file modification in unrelated tasks.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill exposes exec and write capabilities but does not prominently warn users that it may run commands and modify files. In an agent ecosystem, missing disclosure weakens informed consent and makes it easier for the skill to perform side effects unexpectedly when selected for a task.

Static analysis

No suspicious patterns detected.