ClawHub
Back to skill

Security audit

Ozon-竞店截流专家 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill uses a Qinghu API key to fetch and export Ozon competitor-shop data, and those behaviors are disclosed and aligned with its stated purpose.

Install this only if you intend to let the agent use Qinghu credentials for Ozon competitor research. Before approving calls, check which Qinghu tools will be used and that credit costs are acceptable; expect larger result sets to be saved as local exported files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says this skill 'must trigger' for broad competitor-analysis intents, creating an overly aggressive activation boundary. That increases the chance the agent invokes the skill in situations where the user did not intend external data access, paid API usage, or competitive-monitoring workflows. In a skill that can consume tokens, call remote APIs, and export data, broad mandatory triggering materially raises the risk of unintended actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example trigger phrases are generic phrases such as 'analyze this Ozon shop' or 'what is the competitor selling,' which overlap with ordinary discussion and lightweight advice requests. Such ambiguity makes accidental activation more likely, which is more dangerous here because the skill is designed to perform external API calls, cost-incurring operations, monitoring, and data export. The operational nature of the skill makes fuzzy invocation boundaries a real security and safety concern rather than just a UX issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill explicitly instructs the agent to read API credentials from environment variables (QINGHU_TOKEN / QHKIT_TOKEN). Accessing local secrets is a privileged capability and is broader than what is necessary for a simple skill description unless the hosting platform has clearly consented secret injection semantics. In this context, the skill is third-party content and should not be allowed to direct credential retrieval from the runtime environment, because that creates a path for unintended secret use or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs automatic export of datasets to files and even reuse of cached local file paths, without any warning about local file creation, retention, or exposure. Automatic persistence expands the data footprint beyond the immediate response and may store commercially sensitive shop-analysis results on disk without user awareness. Referencing local file paths in skill behavior also increases the risk of unintended disclosure or misuse of local artifacts.

Content

No source excerpt is available for this finding.