Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent diagnostic skill for ClawHub publishing failures, with no hidden execution, persistence, or data exfiltration behavior found.
Before installing, expect the skill to help inspect workflow files, publish logs, owner configuration, and whether ClawHub token/secret wiring exists. Do not paste raw secret values into chat; provide redacted logs or configuration snippets where possible.
The invocation examples in this section are free-form natural-language requests rather than narrowly scoped trigger phrases, and at least one of them is broad enough to match ordinary conversation about CI failures. Without explicit constraints or exclusion conditions, this can cause the skill to be invoked in situations beyond the intended GitHub Actions-to-ClawHub publish-diagnostics context.
Much of the user-facing description and invocation guidance is written in Chinese, which implicitly constrains the skill's operating language and user experience. The file does not indicate that language selection is optional or that the skill is intentionally limited to Chinese-speaking users for a documented reason.
The entire markdown file is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
This markdown reference forces a specific language for all users of the skill documentation, which can violate language/locale policy when no user opt-in or alternative is provided. The file contains operational guidance but does not indicate that Chinese-only content is intentional for a region-specific audience.
No suspicious patterns detected.
