Audit Skills Security
Security checks across malware telemetry and agentic risk
Overview
Prompt-injection indicators were detected in the submitted artifacts (ignore-previous-instructions, you-are-now); human review is required before treating this skill as clean.
This skill appears safe to use for reviewing other skills. Run it only on the specific files or directories you intend to audit, and redact any reported secrets before sharing the results. ClawScan detected prompt-injection indicators (ignore-previous-instructions, you-are-now), so this skill requires review even though the model response was benign.
VirusTotal
2/65 vendors flagged this skill as malicious, and 63/65 flagged it as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill intentionally handles untrusted skill text that may contain prompt-injection attempts.
These prompt-injection strings triggered the static scanner, but in context they are explicitly examples of malicious text the audit should detect in reviewed files.
"忽略之前的指令"、"Ignore all previous instructions" ... "你现在是..."、"You are now..."
Use it for its intended audit workflow and keep treating reviewed file contents as untrusted evidence, not instructions.
If pointed at a large or sensitive directory, the agent may read and summarize more local content than intended.
The skill can recursively inspect many local files under a user-provided directory. This is purpose-aligned for auditing skills, but broad paths could include unrelated private files.
如果是目录：使用 Glob 工具发现所有相关文件 ... 扫描模式：`**/*.md`, `**/*.sh`, `**/*.py`, `**/*.js`, `**/*.ts`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/*.toml`
Only run the audit on the specific skill directory or files you want reviewed.
Secret-looking values in the audited files may appear in the chat/report.
The skill searches for credential-like strings and records matching content. This is expected for a security audit, but it could expose secrets in the generated report if they exist in scanned files.
API_KEY|API_SECRET|APIKEY ... ACCESS_TOKEN|AUTH_TOKEN ... PASSWORD|PASSWD|passwd ... 记录所有匹配结果（文件名、行号、匹配内容）
Avoid sharing audit reports publicly without redacting any keys, tokens, passwords, or private paths.