ClawHub
Back to skill

Security audit

Mit24 Market Segmentation

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only market analysis skill, with no code execution, credential access, persistence, or hidden data handling.

Safe to install as a market-segmentation template. Users should avoid entering confidential customer lists, proprietary financials, or sensitive market research unless they are comfortable sharing that data with their agent environment; non-Chinese users may also find the skill less useful unless translated.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list contains very broad business phrases such as '市场细分', '目标市场', '用户画像', and '客户洞察', which are common in ordinary conversations and can cause the skill to activate outside its intended scope. Over-broad invocation increases the chance of unintended routing, irrelevant instructions being injected into unrelated sessions, and reduced reliability of downstream agent behavior.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The skill is written entirely in Chinese and implicitly enforces Chinese-language interaction without stating that language should follow user preference. In multilingual systems, this can create unsafe or unreliable behavior by overriding user intent, causing misunderstanding of business advice, or producing inaccessible outputs for users expecting another language.

Static analysis

No suspicious patterns detected.