ClawHub
Back to skill

Security audit

Workflow Splitter Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a task-planning helper with disclosed command examples and no evidence of hidden data access, persistence, exfiltration, or destructive behavior.

Before installing, understand that the skill may ask the agent to run workflow-splitter commands for planning and progress tracking. Use it when you want command-assisted workflow decomposition, and review any proposed shell command before execution, especially if the CLI is not already installed or trusted.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
78% confidence
Finding
The skill's activation/scope language is excessively broad, covering many scenarios and keywords without tight constraints. In an agent environment, ambiguous scope can cause the skill to trigger in unintended contexts and steer user workflows toward exec-capable actions, increasing the chance of unsafe or unnecessary command execution.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill advertises exec usage and provides command-driven workflows, but it does not include strong safety warnings, confirmation requirements, or clear limits for system-impacting actions. In a tool-using agent, that can normalize shell execution for routine tasks and lead to unintended local changes, network activity, or command abuse if user input is unsafe.

Static analysis

No suspicious patterns detected.