ClawHub
Back to plugin

Security audit

Principles Disciple

Security checks for vulnerabilities and agentic risk

Overview

This appears purpose-built for local agent governance, but it automatically enables and falls back to conversation capture in ways users should review carefully.

Review this plugin before installing if your chats or tool outputs include secrets, private code, or regulated data. It is local-first and largely disclosed, but it can enable conversation hook access automatically and persist conversation/tool evidence in workspace databases; configure language, telemetry, feature flags, and conversation-access settings deliberately.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The natural-language instructions throughout the skill are entirely in Chinese, including the manifest description and operational guidance. This imposes a specific language/locale on users without offering a choice or explaining a region-specific need, which matches the language policy violation criteria.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill is written entirely in Chinese and does not offer a language choice, translation, or opt-in despite being an interactive guidance skill. This can cause users to misunderstand commands, prompts, and security-related explanations, leading to unintended execution or inability to make informed decisions; the risk is amplified because the skill recommends operational and maintenance actions such as status checks, bootstrap scans, and workspace-cleaning flows.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The manifest description and document instructions are written as mandatory Chinese-language guidance, and the text states the skill is forcibly using a specific mode without any indication that language or locale is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The skill content is written entirely in Chinese and directs the agent to produce a structured implementation report in Chinese-oriented phrasing without any user opt-in or language negotiation. This can override a user's preferred language, reduce transparency, and increase the chance that important implementation details or safety-relevant output are inaccessible to the user or reviewer.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dist/bundle.js:21
Evidence
`),NB=100*1024,Z5t=2e3,eKt=200,qH=class extends Oe{constructor(e){super(`bash command timed out after ${e}ms`),this.name="BashTimeoutError",this.timeoutMs=e}},t...

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dist/governance-audit.js:21
Evidence
`),ZC=100*1024,Act=2e3,yct=200,XB=class extends we{constructor(e){super(`bash command timed out after ${e}ms`),this.name="BashTimeoutError",this.timeoutMs=e}},I...

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dist/rulehost-evidence.js:21
Evidence
`),sk=100*1024,nut=2e3,rut=200,lL=class extends we{constructor(e){super(`bash command timed out after ${e}ms`),this.name="BashTimeoutError",this.timeoutMs=e}},i...

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
dist/bundle.js:2
Evidence
var pNt=Object.create;var Ote=Object.defineProperty;var mNt=Object.getOwnPropertyDescriptor;var fNt=Object.getOwnPropertyNames;var hNt=Object.getPrototypeOf,gNt...

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
dist/governance-audit.js:2
Evidence
var LJe=Object.create;var Dq=Object.defineProperty;var MJe=Object.getOwnPropertyDescriptor;var PJe=Object.getOwnPropertyNames;var FJe=Object.getPrototypeOf,QJe=...

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
dist/rulehost-evidence.js:2
Evidence
var T8e=Object.create;var Yq=Object.defineProperty;var R8e=Object.getOwnPropertyDescriptor;var O8e=Object.getOwnPropertyNames;var D8e=Object.getPrototypeOf,N8e=...

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
dist/bundle.js:2
Evidence
var pNt=Object.create;var Ote=Object.defineProperty;var mNt=Object.getOwnPropertyDescriptor;var fNt=Object.getOwnPropertyNames;var hNt=Object.getPrototypeOf,gNt...

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
dist/governance-audit.js:2
Evidence
var LJe=Object.create;var Dq=Object.defineProperty;var MJe=Object.getOwnPropertyDescriptor;var PJe=Object.getOwnPropertyNames;var FJe=Object.getPrototypeOf,QJe=...

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
dist/rulehost-evidence.js:2
Evidence
var T8e=Object.create;var Yq=Object.defineProperty;var R8e=Object.getOwnPropertyDescriptor;var O8e=Object.getOwnPropertyNames;var D8e=Object.getPrototypeOf,N8e=...