ClawHub
Back to skill

Security audit

政采政策红利落实引擎（采购人版）Govproc Policy Enactor

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Chinese government-procurement drafting assistant with no executable code, hidden installation behavior, or disproportionate authority.

Install this only if you need Chinese government procurement drafting support. Treat outputs as drafting assistance, verify cited rules and local policy currency, and have procurement or legal reviewers confirm final clauses before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The skill description is entirely framed in Chinese and presents the tool as a procurement drafting assistant for Chinese government procurement workflows, with no indication that users may choose another language or locale. Under the policy rule, a skill that imposes a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The markdown explicitly requires outputs in a formal official-document style, and the skill name/display name and all instructions are presented only in Chinese. This creates a language/locale constraint without indicating that the user may choose another language or opt in to Chinese-only output.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The display name and description are entirely in Chinese, which indicates the skill is presented in a single language with no visible opt-in or alternative locale. Under the stated policy, forcing a specific language is a natural-language policy issue unless the locale constraint is explicitly justified or the user is given a choice.

Missing User Warnings

Low
Confidence
76% confidence
Finding
L13 uses the broad input "只说\"帮我落实政策\"" and expects the tool to continue by collecting required slots, but the file does not warn users that responses depend on complete procurement facts and should not be treated as definitive legal compliance advice. Because this is a markdown file describing behavior around regulatory decisions, a brief caution about incomplete inputs and the need to verify against source rules would improve user safety.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.