ClawHub
Back to skill

Security audit

政采质疑函与投诉书智能起草助手Gov Procurement Challenge Drafter

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Chinese government-procurement drafting assistant with no executable code, persistence, credential use, or hidden data handling.

Appropriate for drafting first-pass government procurement challenge or complaint documents. Before using it for real submissions, verify current law, project facts, deadlines, and local finance authority practice; use a lawyer or dedicated compliance support for contract performance, acceptance, payment, bidding-law, or high-value disputes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill explicitly says contract review and related matters are out of scope, but the label mapping still includes '验收不合格/不付款' mapped to '履约验收 + 采购合同'. This can cause the agent to engage with procurement contract performance or acceptance disputes anyway, creating scope creep and potentially generating inapplicable legal guidance outside the intended government procurement challenge/complaint workflow.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.