ClawHub
Back to skill

Security audit

工程质量保证金扣留与退还核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local, deterministic checker for construction retention-money ledger arithmetic, with its free-tier limits disclosed and no evidence of network access, persistence, credential use, or hidden behavior.

Install only if you want a Chinese-language, local checker for retention-money ledger arithmetic. Do not rely on the free version to decide legal entitlement, overdue refund status, deduction reasonableness, interest, or contract cap compliance; the skill explicitly says those checks are not run.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill’s metadata and trigger phrases suggest broader capability around whether retention money should already have been refunded (e.g. '质保金该退没退'), but the document later states the free version does not perform overdue/non-refund determination. This can mislead users into relying on the tool for payment-timing/compliance decisions it does not actually make, causing missed refunds, delayed follow-up, or incorrect assurance from incomplete checks.

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The file’s comments, user-facing messages, advice strings, and result text are written entirely in Chinese, and the skill contract does not indicate that the language is configurable or limited to a China-specific deployment context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The module documentation states '材料不足时绝不给结论' and the contract advertises an insufficient_input path when required material is missing. However, checkRefund explicitly treats an empty '保修期内扣减' field as 0 and emits arithmetic conclusions anyway, which contradicts that documented strictness about insufficient material.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The user-facing description, help text, errors, and operational messages are all written in Chinese, and the file does not provide any opt-in, language selection, or justification that the skill is intended only for a Chinese-language audience. This can violate a language/locale policy when users are forced into a specific language without explicit choice.

Intent-Code Divergence

Low
Confidence
79% confidence
Finding
The top-of-file comment says '`CHECKS_WITHHELD` 只是"未执行的检查项"的说明文本，不是实现'. While the checks are indeed not implemented, run() copies this constant into result.scope.checks_not_run as if it were part of runtime behavior metadata. That does not implement the checks, but it does contradict the comment's implication that the constant is only inert explanatory text.

Intent-Code Divergence

Low
Confidence
89% confidence
Finding
The inline documentation states that non-JSON input will be treated as plain-text material such as '直接粘贴的合同全文', implying broader contract-wide handling. However, the rest of the script consistently positions the skill as operating only on quality-retention ledger/table input, including table headers and specific ledger rows, so the comment overstates supported intent and contradicts the declared narrow scope.

Natural-Language Policy Violations

Low
Confidence
94% confidence
Finding
The JSON value contains only Chinese headers and content, which indicates a fixed language/locale choice in natural-language data. Under the policy, language constraints should either be optional for the user or clearly documented as region-specific; this file provides neither.

Static analysis

No suspicious patterns detected.