ClawHub
Back to skill

Security audit

Duanzj Hello Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a simple hello-world greeting skill with broad trigger wording but no evidence of hidden access, data collection, persistence, or harmful behavior.

Safe to install as a basic demo greeting skill. Be aware it may activate for generic greeting or skill-testing phrases, and review future updates if they add network access, credential handling, install commands, or broader permissions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger section uses broad natural-language examples such as '测试一下技能' and '运行 hello world', which can match loosely phrased user requests and cause the skill to activate when the user may not have intended this specific behavior. In a simple greeting skill the downstream effect is limited, but ambiguous invocation rules still reduce routing precision and can create unintended execution.

Static analysis

No suspicious patterns detected.