ClawHub
Back to skill

Security audit

Agent安全审计免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local security-audit checklist that uses read and shell commands in ways that mostly match its stated purpose, with a minor documentation inconsistency about external API integration.

Install only if you are comfortable letting the agent read and run shell searches over the repository you choose. Treat the external API-integration line as undocumented boilerplate unless the publisher clarifies it, and do not approve any unexpected network calls or writes that go beyond local audit commands.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
77% confidence
Finding
The skill presents itself as a local audit tool, but later claims API integration and external service interaction as a core capability. This mismatch can mislead users about data flow and trust boundaries, causing them to expose sensitive code or credentials under false assumptions about locality.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The documentation states that the free edition is local, knowledge-driven, requires no extra API key, and does not send code externally, yet another section advertises external API integration. Contradictory privacy and execution claims are security-relevant because they can hide or normalize unexpected exfiltration paths.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:381