Security audit
Figma
Security checks for vulnerabilities and agentic risk
Overview
The reviewed skill artifacts are coherent operational/developer guidance and scanner telemetry is clean, with some expected high-authority workflows that users should invoke deliberately.
Install only if you want ClawHub/Convex developer and maintainer workflows. Review before running commands that use authenticated GitHub, Convex, moderation, proof publishing, or the autoreview helper, especially its default full-access nested Codex mode; use the documented opt-outs or confirmation steps when working in sensitive repositories.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.