ClawHub
Back to skill

Security audit

物业纠纷全流程维权

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent property-dispute assistant that creates local legal-information reports, with some privacy and consent cautions but no evidence of malicious behavior.

Before installing, understand that this skill may create a local HTML report containing property-dispute details and draft complaint language. Use it for legal-information support, confirm before generating files, avoid unnecessary personal identifiers, and consult a qualified lawyer before taking major legal action.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list includes broad everyday phrases such as '漏水', '物业问题', and '电梯坏了', which can cause the skill to activate in contexts where the user did not explicitly request this workflow. Unintended activation is risky here because the skill initiates a multi-step legal-analysis and document-generation process that may collect sensitive dispute details and steer users into filing complaints or producing formal reports without clear intent confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs the agent to generate an HTML file, save it to the current working directory, and present it to the user, but it does not require explicit user consent or a clear notice that a file will be written. This creates a file-write side effect that may surprise users, persist sensitive legal-dispute information locally, and increase privacy risk because the report may contain evidence summaries, complaint drafts, and contact details.

Static analysis

No suspicious patterns detected.