ClawHub
Back to skill

Security audit

Ux Architect

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only UX architecture helper with no install scripts, credentials, network behavior, or hidden execution.

Install this as a UX architecture assistant if you are comfortable with it reading project planning files you provide to the agent. Keep normal repository access controls in place, especially in projects containing private product plans or sensitive implementation details.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation instruction says to reference the agent by name or specialty whenever its expertise is needed, but it provides no explicit scope boundaries, authorization checks, or task constraints. In multi-agent or tool-using environments, this kind of broad trigger language can cause over-invocation, role confusion, or unintended delegation into architecture and UX decisions outside the user's intended scope.

Static analysis

No suspicious patterns detected.