ClawHub
Back to skill

Security audit

播客

Security checks for vulnerabilities and agentic risk

Overview

This podcast skill is a coherent media-planning and production guide with expected local audio/video command examples and no evidence of hidden, deceptive, or destructive behavior.

Before running the example commands, use trusted local media paths, review output filenames to avoid overwriting files, and keep any API keys in environment variables rather than committing them to projects.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill includes shell commands and positions itself as an MD+execute() skill with read/exec/write tools, but it does not provide strong safety guidance around executing commands on user-supplied file paths or modifying files. In an agent context, this can lead to unsafe shell execution, accidental overwrites, or processing of attacker-controlled paths if the agent turns markdown examples into live commands without validation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.