ClawHub
Back to skill

Security audit

sanguosha-hero

Security checks for vulnerabilities and agentic risk

Overview

This is a simple game-reference skill that looks up public Sanguosha character skill information and does not request privileged access.

Safe to install for Sanguosha standard-edition hero skill lookups. Be aware that ambiguous character-name questions could trigger this skill unexpectedly, and avoid including private information in lookup prompts because it uses web search.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger definition is overly broad because it allows activation based on directly mentioning common historical character names like 赵云、诸葛亮、张飞, which can appear in non-game contexts. This can cause unintended skill invocation, leading the agent to perform unnecessary web searches and return irrelevant content, though the scope is limited to informational lookup rather than privileged actions.

Static analysis

No suspicious patterns detected.