ClawHub
Back to skill

Security audit

客诉质量分析技能

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to process user-provided complaint files locally, with a privacy caveat that small raw previews may appear in its analysis output.

Install only for complaint datasets you are comfortable having analyzed by the agent. Review generated JSON and reports before sharing them, because small raw row previews, customer names, complaint descriptions, or other business-sensitive values may be included.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script includes `data_preview` rows and per-column `sample_values` directly in its JSON output, which can expose customer names, complaint descriptions, contact details, or other sensitive business data from uploaded complaint files. In this skill context, the input is specifically customer complaint/after-sales quality data, so returning raw records is more dangerous than in a generic analytics tool because such datasets commonly contain personal and confidential operational information.

Static analysis

No suspicious patterns detected.