ClawHub
Back to skill

Security audit

独立审计工具（免费版）

Security checks across malware telemetry and agentic risk

Overview

The skill is a generic audit assistant, but it requests exec/write authority and mentions modify/delete operations without clear user controls or limits.

Review this before installing if you expect a read-only audit helper. Use it only with explicit prompts that limit it to passive analysis or report generation, and require confirmation before it runs shell commands, writes files, modifies artifacts, deletes anything, installs packages, pings network targets, or sends results to a callback URL.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The skill’s activation examples and scope are broad enough that a host agent could invoke it for loosely related prompts like general 'audit' or 'check compliance' requests without clear boundaries, increasing the chance of unintended execution. In a skill that also advertises exec/write capabilities, ambiguous triggering materially raises the risk of the agent performing filesystem or command actions when the user did not explicitly request them.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill declares read/exec/write tools and describes create/query/export/modify/delete capabilities without prominently warning users which actions can affect the local system or files. Because the skill is framed as an audit utility, users may reasonably expect passive analysis, making it more dangerous if an agent decides to execute commands or modify artifacts under the broad operational language.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.