ClawHub
Back to skill

Security audit

Adaptive Agent: Skill Review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent skill-maintenance helper, but it can modify and commit changes to other skills without a clear approval gate.

Install only if you want an agent to help maintain other skills. Before using it, ask the agent to run a read-only audit first, show proposed diffs, and get separate approval before editing files or creating a commit.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly directs the agent to patch skill files and then commit the changes, but it does not warn the user that running the skill can modify repository contents. In an agent setting, silent write-and-commit behavior is risky because a user may invoke a review-oriented skill expecting analysis only, while the skill performs persistent changes to prompts/procedural memory.

Static analysis

No suspicious patterns detected.