ClawHub
Back to skill

Security audit

凯米心跳插件

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small disclosed Web UI visual enhancement and does not show evidence of data access, credential use, network calls, or destructive behavior.

Install this only if you want the visible heartbeat/status changes in the Web UI. Review the npx install step before running it, since that command may fetch and execute package code outside the provided skill artifact.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.