ClawHub
Back to skill

Security audit

管理体系整合技能

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for helping users combine ISO-style management systems, with no hidden execution, credential use, or persistence.

Before installing, treat generated manuals and comparison reports as templates that should be reviewed by qualified internal owners or auditors before use in a real compliance program.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger condition is broad enough that the skill could activate for loosely related requests about management improvement or system optimization, causing unintended routing. In this skill, the impact is limited because the content is a documentation-oriented, non-executing workflow, but over-triggering can still lead to inappropriate handling of user requests or confusion in multi-skill environments.

Static analysis

No suspicious patterns detected.