ClawHub
Back to skill

Security audit

AI Observability（AI可观测性监控）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local AI observability guide with simple offline helper scripts and no evidence of hidden data access, networking, persistence, or destructive behavior.

Before installing, treat this as an advisory playbook and local checklist tool, not a monitoring product. Review the mixed MIT license and additional knowledge-copyright language if redistribution or commercial reuse matters to you.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The file explicitly mandates a fixed branding string ("品牌署名统一用「注册老炮」") for outward-facing releases, which can override user or deployer intent and cause unauthorized attribution in generated outputs or packaged artifacts. In an agent skill context, hard-coded branding requirements are risky because they may pressure downstream systems to emit non-user-approved content, creating reputational, compliance, or policy conflicts.

Static analysis

No suspicious patterns detected.