ClawHub
Back to skill

Security audit

publish-pipeline

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward publishing workflow skill whose deploy and file-editing powers are disclosed and aligned with its purpose.

Install this only if you want an agent to help run real publish/deploy workflows. Before using it on production, make sure the target environment, deploy command, rollback command, and announcement channel are clearly specified in the project docs, and ask for an explicit preview or confirmation step when changes could go live publicly.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
78% confidence
Finding
The phrase 'publish this' is an ambiguous activation cue that could cause the skill to trigger on underspecified requests and proceed toward build/deploy actions without sufficient confirmation. In a skill with exec, write, and deploy-oriented behavior, vague invocation language increases the chance of unintended operational changes to code, content, manifests, or live environments.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This section instructs the agent to perform system-affecting actions such as editing manifests, building, deploying, rolling back, and announcing, but it does not include an explicit warning that these steps can modify live systems or publish irreversible changes. Because the skill is user-invocable and allowed to use exec/write/edit, the missing safety guardrails materially increase the risk of accidental production changes or destructive rollback/deploy behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.