ClawHub
Back to skill

Security audit

Organize Task Package

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently helps organize task documentation and gated worker/reviewer coordination without hidden data collection or destructive behavior.

Install this only where you want Codex to read repository state and create task-package files. Review the proposed launch configuration before confirming any Worker, Reviewer, worktree, external run, migration, push, or cleanup action.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill explicitly instructs the agent to read repository state and write task-package files, but it declares no corresponding permissions. That mismatch weakens least-privilege controls and can cause users or orchestrators to invoke a skill with broader file access than is transparently documented, increasing the chance of unintended repository reads or writes.

Static analysis

No suspicious patterns detected.