ClawHub
Back to skill

Security audit

企业人事技能包

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Chinese HR/payroll reference skill with legal accuracy caveats but no hidden execution, data collection, or persistence.

Install only if you want a Chinese HR/payroll reference aid. Treat its labor-law, tax, social-insurance, and payroll formulas as templates to verify against your current city/province rules and company policies before using them for decisions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list contains very broad terms such as “HR”, “人事”, “工资”, and “绩效”, which can cause the skill to activate for many unrelated requests. In an HR skill that provides operational guidance, payroll formulas, and compliance advice, unintended invocation can misroute user interactions and surface misleading locale-specific or domain-specific instructions when the user did not request this skill.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The description frames the skill as authoritative for listed-company HR workflows and Chinese labor/payroll rules without clearly declaring that its content is jurisdiction-specific. If invoked by users in other locales, they may rely on incorrect legal or payroll guidance, creating compliance and decision-making risk rather than classic code-execution risk.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The trigger set is heavily locale-specific and mixes English and Chinese terms, but the skill does not document that its legal standards, tax rules, and social insurance calculations are China-specific. This increases the chance that users searching generic HR terms will receive advice that appears generally applicable when it is only valid in a specific jurisdiction.

Static analysis

No suspicious patterns detected.