ClawHub
Back to skill

Security audit

identity-verify

Security checks for vulnerabilities and agentic risk

Overview

This is a small markdown-only identity verification helper with somewhat broad activation wording but no code, persistence, or hidden data access.

Before installing, be aware that the skill may activate on broad identity or verification wording. Use it for explicit entry/session identity checks, and ensure any referenced authority configuration is a clearly identified read-only file.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger keywords are extremely generic ('identity' and 'verify'), which can cause the skill to activate in many unrelated conversations about identity, verification, authentication, or account topics. In an identity-focused skill, unintended activation is more concerning because it may cause the agent to make authoritative-sounding identity claims in the wrong context, creating confusion, misattribution, or trust boundary mistakes.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest description contains a large set of broad trigger phrases such as identity questions and new-session self-check prompts that can overlap with ordinary user conversation. This increases the chance the skill activates outside the user's explicit intent, causing unintended identity assertions or behavioral steering in unrelated chats.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The description explicitly frames behavior and responses in Chinese without indicating user choice, which can override user language preference or cause unexpected language switching. While not a direct code-execution issue, it is a prompt-behavior vulnerability because it can degrade reliability, confuse users, and create unintended control over response format.

Static analysis

No suspicious patterns detected.