ClawHub
Back to skill

Security audit

Ops Issue Follow-up

Security checks for vulnerabilities and agentic risk

Overview

This skill is a non-executable checklist for structured operations issue follow-up, with no hidden install behavior or automatic data access.

Install this if you want Codex to follow a structured operations-investigation workflow. Use it for clearly scoped project or system issues, and confirm the target project or service before allowing broad code, config, or log review.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description is broad enough to trigger on common terms like 'follow up,' 'analyze,' or '@mentioned' for many operational conversations, which can cause the agent to activate in ambiguous contexts. Over-broad activation can lead the agent to enter investigative workflows unnecessarily, increasing the chance of unintended repository inspection, command execution, or context gathering in projects unrelated to the user's actual intent.

Static analysis

No suspicious patterns detected.