ClawHub
Back to skill

Security audit

HAP升级指南

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed HAP private-deployment upgrade guide generator; it includes powerful operational commands, but they are aligned with its stated purpose and not hidden or deceptive.

Install only if you need HAP private-deployment upgrade assistance. Before executing any generated command, verify it against the current official documentation, confirm backups and rollback plans, use a maintenance window, and keep real passwords or tokens out of generated guides, screenshots, tickets, and shell history.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill declares extremely broad mandatory triggering for anything related to HAP private-deployment upgrade decisions or execution. That increases the chance the agent will invoke this high-authority, action-oriented skill in ambiguous contexts, potentially bypassing safer generic handling and steering users into sensitive operational workflows unnecessarily.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs generation of executable upgrade documentation and direct HTML file output without an explicit user-facing warning about file creation or overwrite behavior. In an agent environment with write capabilities, this can cause unintended artifact creation, overwriting existing files, or silent persistence of sensitive operational content.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The file presents operationally impactful upgrade commands, including service restarts, rolling/non-rolling updates, image imports, and remote-script execution via curl|bash, but does not pair them with explicit warnings to verify version, deployment mode, backups, maintenance window, rollback plan, or command applicability before execution. In a skill that is triggered for real HAP private-deployment upgrade execution, users may copy-paste these commands directly, increasing the chance of service interruption or incorrect changes from context confusion or stale parameters.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The MongoDB examples instruct users to enter credentials and create database users, but they lack warnings about secret exposure, shell history leakage, least-privilege account use, password handling, and avoiding publication of real credentials in generated guides or logs. Because this skill is meant to generate upgrade documentation and commands for deployment operators, the absence of secret-handling guidance makes accidental credential disclosure more likely.

Static analysis

No suspicious patterns detected.