ClawHub
Back to skill

Security audit

拍照解题

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward photo homework-solver skill that reads user-provided problems and creates a local HTML solution report.

Before installing, be aware that the skill may activate on broad homework-solving phrases. Use it with user-provided practice problems or photos, and review the generated HTML report before sharing it because it may include the submitted problem content.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list contains very broad phrases such as '解题', '帮我解题', and 'solve this problem' that can match ordinary user requests outside the intended skill boundary. This can cause unintended invocation of the skill, increasing the chance that user content is routed into file-writing and web-fetch behavior without clear user intent.

Static analysis

No suspicious patterns detected.