ClawHub
Back to skill

Security audit

Ai Productivity Audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a code-review helper that runs external reviewer CLIs with disclosed, mostly read-only controls; its local file writes are opt-in report outputs rather than hidden persistence.

Install if you want an agent-assisted code review helper and are comfortable sending selected git diffs and reviewer context to the configured AI tools. Before use, confirm which engine is selected, disable web search if not needed, avoid reviewing secret-bearing changes, and use explicit report output paths only where overwrites are acceptable.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to offer writing the report to a local path under the user's home directory without any safety note, confirmation requirement, or constraint on file-modifying behavior. In agent environments with file system access, this can normalize local file writes and lead to unintended persistence, overwriting existing files, or surprising modification of user data.

Static analysis

No suspicious patterns detected.