ClawHub
Back to skill

Security audit

房产信息查询

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real-estate research helper that searches public housing sources and creates a local HTML report, with no hidden credential use or destructive behavior found.

Install this if you want an agent to perform real-estate web research and generate local HTML reports. Be aware that broad housing, school, or neighborhood phrases may trigger it, and verify any property, pricing, or school-district claims against official or current sources before acting.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list is extremely broad and includes many common housing-related terms, making unintended activation likely during ordinary conversation. This can cause the agent to invoke web-searching and report-generation behavior without sufficiently clear user intent, increasing the chance of unnecessary data collection, confusion, or action on loosely related prompts.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation logic says the skill should run whenever the user mentions broad topic words like housing, schools, or neighborhoods, but does not define clear scope boundaries or require explicit consent. In context, this skill performs external searches, scraping, and HTML output generation, so ambiguous activation is more dangerous because it can trigger network activity and produce authoritative-looking results from casual mentions.

Static analysis

No suspicious patterns detected.