ClawHub
Back to skill

Security audit

多代理开发框架

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed multi-agent coding workflow; its broad code-editing permissions fit that purpose but require normal repository caution.

Install this only for repositories where you are comfortable letting an agent read files, run development commands, edit code, and create commits. Review the plan and outputs before using it on sensitive projects or with secrets in the workspace.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill advertises read, exec, write, glob, and grep capabilities and describes automated multi-agent execution, but it does not provide user-facing guardrails on what may be read, modified, or executed. In an agent platform, this can normalize broad filesystem access and command execution without explicit consent boundaries, increasing the risk of unintended code changes, sensitive file access, or dangerous shell actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.