ClawHub
Back to skill

Security audit

postgres-job-queue

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-style skill for designing a PostgreSQL-backed job queue, with some overly broad activation wording but no hidden or disproportionate behavior.

Install this only if you want help designing or implementing a Postgres-backed job queue. Be aware that its broad trigger wording may make an agent invoke it for unrelated mentions of jobs, queues, or priorities, so users should treat its advice as relevant only to database queue design tasks.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
94% confidence
Finding
The trigger keywords include extremely generic terms such as 'based', 'priority', 'job', 'queue', and 'postgres', which are likely to match ordinary conversation and cause unintended skill activation. In an agent environment, over-broad activation boundaries can route unrelated user requests into this skill's instructions, increasing the chance of incorrect automated actions or confusing behavior.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The invocation guidance is generic and does not define clear boundaries for when this skill should or should not activate beyond broad 'applicable scenarios'. Ambiguous activation logic can cause the agent to apply database queue patterns in contexts where they are irrelevant, leading to unsafe automation choices, wrong recommendations, or accidental use of the skill during unrelated workflows.

Static analysis

No suspicious patterns detected.