ClawHub
Back to skill

Security audit

企业成本核算技能包

Security checks for vulnerabilities and agentic risk

Overview

The available evidence shows a finance/accounting-oriented skill with broad activation phrases, but no malware, hidden execution, credential use, persistence, or destructive behavior.

This appears safe to install based on the supplied evidence. Be aware that broad trigger phrases may make it activate during ordinary finance or accounting conversations; install it if that behavior is acceptable, and review its SKILL.md if you want tighter activation scope.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list contains broad, generic finance and accounting terms such as '成本分析', '成本控制', and '盈亏平衡' that are likely to appear in ordinary conversation. This can cause the skill to activate outside clearly intended contexts, increasing the chance of prompt hijacking, unintended routing, or overexposure of the skill's instructions and content.

Static analysis

No suspicious patterns detected.