ClawHub
Back to skill

Security audit

Windsurf

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable Windsurf IDE guide that describes powerful AI coding features but does not itself run code or hide risky behavior.

Installing this skill is reasonable as a reference guide. When using Windsurf/Cascade itself, prefer Chat mode or scoped @file/@folder context for sensitive work, review diffs and dependency or git changes before accepting them, and be careful with global rules because they can affect future projects.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly encourages an autonomous agent mode that can read/write files and run terminal commands, but it does not include a clear warning that these actions may change source code, install packages, modify git state, or otherwise affect the local system. In a developer-tool skill, that omission is risky because users may treat the guidance as routine usage advice and delegate high-level goals without understanding the side effects of autonomous execution.

Static analysis

No suspicious patterns detected.