ClawHub
Back to skill

Security audit

verification-before-

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to run verification before claiming work is complete, but its command-running authority is broad and poorly scoped.

Review before installing. This does not show malicious behavior or hidden persistence, but it gives an agent exec capability without concrete command limits. Only use it in repositories where you are comfortable with the agent running verification commands, and prefer a version that names the exact allowed commands or requires user confirmation before execution.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises generic command execution capability via the exec tool while only stating, in prose, that 'whitelisted commands' should be used. No actual whitelist, validation logic, or constrained command set is defined in the skill, so an agent could execute arbitrary verification commands or user-influenced shell commands under the guise of routine operation. In a development automation skill, this creates a realistic path to command injection or unsafe local execution.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger condition says the skill activates 'when the user needs to execute related operations,' which is so broad that it could match many unrelated requests. Because the skill has exec capability, unintended activation materially increases the chance that commands are run in the wrong context, on the wrong repository, or without clear user intent. The vague description elsewhere in the file makes this overbroad activation more dangerous, not less.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.