Security audit
Security checks for vulnerabilities and agentic risk
This is a small Chinese dashboard that fetches UUMit asset data and does not show hidden commands, credential use, persistence, or destructive behavior.
Before installing, understand that the page is Chinese-language and will contact the UUMit API from the browser to load live asset data. The artifact also names a specific ClawHub account, but no code was found that logs in, reads credentials, or changes account data.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
The skill declares direct communication with an external API endpoint to retrieve live data. External transmission is not automatically malicious, but in this context it becomes security-relevant because the skill also references use of a logged-in account and does not describe data minimization, consent, failure handling, or any boundary between local/account data and third-party requests.
## 数据源
- **UUMit API**: `https://api.uumit.com/api/v1/digital-assets`
- **ClawHub**: 使用已登录的 `@cx75227-ops` 账户
- 网页前端直接通过UUMit公开API获取实时数据
The skill explicitly states it uses a logged-in ClawHub account and fetches live data from an external API, but it does not warn the user that actions may occur in the context of that authenticated account or that external requests will be made. This creates a real transparency and consent issue: users may expose account context, trigger unintended account-linked operations, or disclose usage metadata to third-party services without informed approval.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
async function loadData() {
document.getElementById('updateTime').textContent = new Date().toLocaleString('zh-CN');
try {
const r = await fetch('https://api.uumit.com/api/v1/digital-assets');
const d = await r.json();
if (d.data?.items) {
document.getElementById('assetCount').textContent = d.data.items.length;
The skill name, description, and tags are entirely in Chinese, with no indication that the skill is region-specific or that users can choose another language. For a general skill manifest, this creates a natural-language policy concern because it effectively imposes a specific language/locale without opt-in.
The natural-language instructions and descriptions in this file are entirely in Chinese, which effectively forces a specific language experience. There is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
The document declares lang="zh-CN", which fixes the page to Simplified Chinese. Under the policy rule, locale constraints should either be optional for the user or clearly justified as region-specific; this file provides no such choice or justification.
toLocaleString('zh-CN') forces all users to see date/time formatting in the Chinese locale. This is a natural-language/locale policy issue because it imposes a specific locale choice without offering an alternative or documenting a justified regional scope.