ClawHub Skill Security Audit

Overview

Perform comprehensive security risk assessment on ClawHub skills before installation. This skill combines automated static analysis with structured expert review to detect prompt injection, malicious code patterns, supply chain attack indicators, and data exfiltration risks — informed by real-world attack cases like the ClawHavoc campaign.

Workflow

Step 1: Determine Skill Source

The user may provide one of the following as input:

1. Local directory path — Skill already downloaded to disk (e.g. ./skills/skill-security-audit/)
2. ClawHub slug — Just the skill name (e.g. skill-security-audit, stock-price-query)
3. ClawHub URL — Full URL like https://clawhub.ai/tjefferson/skill-security-audit or https://clawhub.ai/tjefferson/stock-price-query

For cases 2 and 3, extract the slug from the input. If it's a URL, the slug is typically the last path segment (e.g. https://clawhub.ai/tjefferson/stock-price-query → slug is stock-price-query).

No local installation is required beforehand — the scanner handles downloading automatically.