ClawHub
Back to skill

Security audit

Solo Dev Companion Free

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-only skill automates a local TDD workflow that edits project files and makes git commits, and its sensitive behavior is disclosed and aligned with that purpose.

Install only if you want an agent to run local development commands, edit repository files, and create git commits from docs/plan tasks. Review diffs and generated commits before pushing, and be aware the activation wording is broader than ideal.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation scope is excessively broad and keyword-driven, which increases the chance the skill is invoked in contexts beyond its intended purpose. In an agent environment with exec access, ambiguous triggering can lead to unintended repository modifications, command execution, or workflow actions without sufficiently precise user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly describes automatically committing code and updating plan files, but it does not prominently warn users that repository state will be modified. In a tool-enabled agent with exec permission, silent or insufficiently disclosed state changes can cause irreversible source-control actions, pollute history, or commit sensitive/unreviewed content.

Static analysis

No suspicious patterns detected.