ClawHub
Back to skill

Security audit

目录树生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a simple directory-tree-to-HTML helper, with the main risk being that users may include sensitive file or folder names in the generated output.

Before using or sharing the generated HTML, review and redact directory listings for usernames, absolute paths, internal repository names, customer/project identifiers, .env or secret-related filenames, and other sensitive metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
92% confidence
Finding
The skill explicitly encourages users to paste raw directory listings, which can contain sensitive project names, internal paths, customer identifiers, usernames, environment names, or secret-bearing filenames. Because the skill generates shareable HTML from that data and the documentation provides no privacy warning or redaction guidance, users may inadvertently expose sensitive metadata when saving or sharing the output.

Static analysis

No suspicious patterns detected.