ClawHub
Back to skill

Security audit

外卖比价

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed takeout and food price-comparison helper that uses web search and generates a local HTML report, with no evidence of credential access, persistence, exfiltration, or destructive behavior.

Safe to install for takeout or food price comparison, but expect it may activate on generic price-checking requests. Review prices in the actual apps before buying, and be aware that opening the generated HTML report may load chart code from a CDN.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes broad everyday phrases like 比价, 查价格, 哪个便宜, and 省钱 that can match many unrelated shopping or budgeting conversations. This can cause unintended activation of a skill that performs web searches and file generation, expanding its opportunity to handle user input when it was not explicitly requested.

Vague Triggers

Low
Confidence
90% confidence
Finding
The English triggers compare price and waimai compare are generic enough to activate on broad product-comparison queries outside the intended external-food-delivery context. Unnecessarily broad activation increases the chance of accidental invocation and unintended web-search behavior.

Static analysis

No suspicious patterns detected.