ClawHub
Back to skill

Security audit

稽影 · 多Agent信任基础设施

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent, user-started local multi-agent app guide, with the main caution being that API key handling is not documented in detail.

This appears acceptable to install if you are comfortable running the linked local app. Use a restricted DeepSeek API key if possible, avoid hardcoding or committing it, review the repository before running npm install or Electron mode, and check where the app stores audit logs, indexed knowledge, and credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
84% confidence
Finding
The quick-start instructions tell users to configure a DeepSeek API key but do not include guidance on safe handling, storage, scope, or avoiding accidental exposure. In a skill meant for multi-agent orchestration and local/server operation, this omission can lead users to paste secrets into insecure locations, commit them to source control, or expose them through logs and UI state.

Static analysis

No suspicious patterns detected.