ClawHub
Back to skill

Security audit

project-doc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a scoped documentation helper that creates or updates a disclosed PROJECT.md file and does not request command execution, network access, credential use, or background persistence.

Install this if you want an agent to maintain a PROJECT.md in your project root. Before use, confirm the project root and expect it to read or edit only that file; review generated documentation so it does not accidentally preserve sensitive project details you did not intend to record.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Anti-patterns

- Generating a generic template without asking what matters.
- Letting PROJECT.md go stale (no changelog, no notes log).
- Duplicating what the code already documents.
- Creating PROJECT.md in the wrong place (must be at project root).
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.