ClawHub
Back to skill

Security audit

skill-lesson-kit

Security checks for vulnerabilities and agentic risk

Overview

This skill creates Agent Skill course homework materials as Markdown files, with only minor cautions about broad triggers and local file creation.

Install only if you want an Agent Skill course homework generator. Expect it to create two Markdown files in the active workspace when used, and review the output filenames if the workspace already has similar homework documents.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger keywords include broad, everyday educational phrases such as '复习', '出作业', and '练习题' that are only loosely constrained by the description. This can cause the skill to activate in contexts unrelated to Agent Skill internals, leading to unintended behavior or overshadowing more appropriate skills.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The workflow explicitly instructs the agent to write two files into the current workspace without any user confirmation or warning that local files will be created or modified. In an agent environment, this can lead to surprising filesystem side effects, accidental overwrites, or unauthorized persistence of generated content.

Static analysis

No suspicious patterns detected.