ClawHub
Back to skill

Security audit

资产底牌｜护城河解剖

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent stock-analysis skill made of markdown instructions and templates, with no code execution or hidden access, though users should avoid uploading sensitive financial documents unless needed.

Install only if you want investment-research style analysis of public companies. Treat outputs as research assistance, not personalized financial advice, and avoid uploading confidential reports, personal data, or proprietary documents unless you are comfortable having them processed for the requested analysis.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger section includes broad catch-all wording such as similar questions, which can cause the skill to activate outside its intended stock-analysis scope. Overbroad activation increases the chance that unrelated user inputs or uploaded materials are routed into financial-analysis behavior, creating misleading outputs and expanding the surface for unsafe file processing or inappropriate investment guidance.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly supports uploaded PDF, Word, Excel, and image files with automatic content recognition, but it does not warn users that uploaded files will be processed and analyzed. This creates a transparency and consent problem: users may provide sensitive reports, notes, or proprietary documents without realizing they will be ingested automatically, increasing privacy, confidentiality, and compliance risk.

Static analysis

No suspicious patterns detected.