ClawHub
Back to skill

Security audit

噗滋慈善 - 管理顾问 / pozzzi-charity management-advisor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese charity-management Q&A advisor with proportionate local knowledge-base use and no evidence of hidden, destructive, or exfiltrating behavior.

Use this as a reference aid, not legal, tax, fundraising, or HR advice. Avoid entering beneficiary names, phone numbers, ID numbers, or sensitive case details, use a trusted model provider, and confirm where any configured storage adapter keeps audit logs.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill metadata and description identify a general-purpose 'management-advisor' capability but do not define when it should or should not activate, what management domains it covers, or what user intents are in scope. In agent environments, ambiguous scope can cause over-broad invocation and inappropriate use in sensitive contexts, especially since the file also includes only high-level disclaimers rather than operational boundaries.

Static analysis

No suspicious patterns detected.