ClawHub
Back to skill

Security audit

快标书标书智能写作

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Chinese bid-document API client that uploads user-selected tender files to its service and stores a local App Key, with no evidence of hidden exfiltration or destructive behavior.

Before installing, confirm you are comfortable uploading tender and bid documents, which may contain business or personal information, to biaoshu.zhiliaobiaoxun.com under your App Key account. Keep the App Key out of chat, use the default API base unless you intentionally trust another endpoint, and be aware that local credentials, generated reports, and a small project-name cache may remain on disk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The generated HTML sets `lang='zh'`, and the report content and labels throughout the file are fixed in Chinese. This enforces a specific language/locale in the skill output without any user opt-in or alternative selection, which matches the language/locale policy violation criteria.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.