ClawHub
Back to skill

Security audit

证照与特种设备年检到期台账核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local ledger-checking skill whose code matches its disclosed free-version purpose and does not show network use, persistence, credential access, or destructive behavior.

Install only if you want a Chinese-language, local checker for copied certificate or special-equipment expiry ledger text. It does not read .xlsx directly and does not perform the fuller paid-tier risk ranking, 30/60/90 day scheduling, budget-difference checks, or treatment worklist features.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
就用户给出的“Declared Purpose”本身而言，代码大体匹配：它确实围绕证照/特种设备台账做日期与状态一致性核对，并按行给出结论，且基准日取自台账内部最新日期，不取系统当天，也没有越权资源访问或无关触发行为。真正的问题在于，代码文件自身多处文案提到‘完整档’和‘到期风险分级/处理清单’等能力，但实现中明确把这些列为 checks_not_run，仅执行免费档 7 项。因此，若严格判断“描述是否准确代表实际代码”，当前整体描述存在一定夸大/泛化：实际是免费子集实现，而不是完整核查能力。故判定为轻度到中度不匹配，主要是能力范围被描述得比真实执行更宽。

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Vague Triggers

Medium
Confidence
89% confidence
Finding
The description lists trigger phrases including “月度合规检查,” which is a broad business activity rather than a specific invocation phrase. Because many unrelated compliance tasks could mention this phrase, it may cause unintended skill activation outside the narrow ledger-reconciliation use case.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The file’s natural-language documentation, user advice, disclaimer text, and examples are written entirely in Chinese, and user-facing output strings throughout the skill also assume Chinese input and responses. There is no opt-in, language-selection mechanism, or documentation stating that this is intentionally limited to a Chinese-only regulatory context, so it violates the language/locale choice policy.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
Most of the operational instructions and examples are presented only in Chinese, including required column names and usage guidance, while the skill does not state that language choice is optional or region-specific. This can function as an implicit language constraint without explicit user opt-in or justification in the main instructions.

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
The user-facing capability name, usage text, help output, and runtime messages are entirely in Chinese, and the file does not indicate any user opt-in or alternative language support. This creates a natural-language locale constraint that is not documented as optional or region-specific.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The JSON template contains only Chinese-language field labels and values in its natural-language content. For a general-purpose skill artifact, this can represent a locale/language policy issue because it imposes a specific language without indicating user selection, opt-in, or a documented region-specific justification.

Static analysis

No suspicious patterns detected.