ClawHub
Back to skill

Security audit

产品检验规程技能生成技能

Security checks for vulnerabilities and agentic risk

Overview

This skill generates product inspection procedure documents from user-provided materials, and its file-writing behavior is disclosed and aligned with that purpose.

Before installing, use it only with product and quality documents you are comfortable processing locally, and check the JSON and .docx output paths to avoid overwriting an existing file. The reviewed artifacts did not show hidden network transfer, credential use, background execution, or destructive behavior.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs generating and saving JSON and Word files in the working directory without explicit user warning or constraints on output paths. In agent environments, silent file creation or overwriting can affect local data integrity, leak sensitive extracted product information into unintended locations, or cause confusing side effects if filenames or paths are user-influenced.

Static analysis

No suspicious patterns detected.