ClawHub
Back to skill

Security audit

fullstack-softwareddeveloper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plain Markdown guidance skill for Golang and Angular web app development, with no hidden execution, persistence, or data access behavior found.

This skill appears safe to install as a development helper. Users should still review generated authentication and authorization code carefully before production use, because security-sensitive code needs project-specific testing and validation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger condition is broad enough to activate on a wide range of generic web-development requests, which increases the chance the skill is invoked outside its intended secure Golang+Angular scope. In a code-generating skill that claims to provide security architecture and JWT/RBAC implementations, overbroad activation can lead to inappropriate or unsafe guidance being applied without clear boundaries or constraints.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The file presents headings in Chinese while the main description and rules are in English, but it does not state how language should be selected based on user preference. This can create an implicit language policy or inconsistent locale behavior without explicit user opt-in.

Scope Creep

Low
Category
Excessive Agency
Content
## 技能触发条件

Users provide web application development requirements (especially based on Golang and Angular), including but not limited to user registration, role-based data management (e.g., vehicle info), JWT security implementation, and overall application architecture design requests.

## 技能执行规则
Confidence
77% confidence
Finding
The phrase 'including but not limited to' creates open-ended scope, which weakens guardrails and makes it easier for the skill to drift into adjacent tasks not explicitly reviewed for safety. In a development skill that may generate authentication, authorization, and security-sensitive code, such scope creep can increase the risk of unvetted advice or insecure implementations being produced.

Static analysis

No suspicious patterns detected.