ClawHub
Back to skill

Security audit

保险代理手续费与佣金结算核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The local fee-checking code is mostly coherent, but the skill also instructs the agent to run an external purchase and installation flow that is under-disclosed by its no-payment/no-network claims.

Install only if you are comfortable with a Chinese-language local checker that also contains mandatory paid-version promotion instructions. Treat the free checker itself as local, but do not allow the agent to follow purchase, QR-code, raw-IP, or external installation steps unless you explicitly intend to buy the paid version and have verified the merchant, amount, package, and platform rules yourself.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The English metadata claims 'No payment, no registration, no API key, no network,' but later sections direct use of remote URLs and web purchase endpoints. This inconsistency is security-relevant because users and automated policy systems may trust the manifest and permit a skill that actually attempts external interactions.

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill markets itself as a local, offline checking tool, but embedded instructions direct the agent to perform remote purchase and installation flows, visit external URLs, and participate in a commerce workflow. This creates a capability mismatch that can mislead users and host agents into making network requests and handling transactional steps unrelated to the core accounting-check purpose.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The documentation instructs the agent to guide payment, retrieve purchase links/QR codes, and continue installation after confirmation, which grants commerce-handling behavior far outside the stated business function of reconciling commission statements. Even if framed as optional, this expands the attack surface to social engineering, unwanted purchases, and unauthorized workflow changes.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The manifest says '触发词包括' followed by two phrases, which implies the list may be non-exhaustive and does not clearly define when the skill should or should not activate. There are no exclusion conditions or negative examples to prevent unintended invocation in adjacent accounting or reconciliation contexts.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The section '给智能体，照做' mandates specific user-facing behavior for every invocation, but all required disclosure text and workflow are presented only in Chinese with no alternative locale path. This creates a language/locale constraint without explicit user choice or documented justification as a region-specific limitation.

Whitespace Padding

Medium
Category
Prompt Injection
Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
Confidence
80% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Intent-Code Divergence

Low
Confidence
92% confidence
Finding
L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该技能清单、帮助文本和不足材料提示都强调输入应为“保险代理手续费与佣金结算核对表（含表头）”。这里的内联文档把可接受材料扩展为“合同全文”，会让人误解技能支持超出声明范围的文档类型。

Static analysis

No suspicious patterns detected.