ClawHub
Back to skill

Security audit

汇付支付历史最强 Doctor：基于证据的支付诊断手册 (让你的AI不再胡思乱想）

Security checks for vulnerabilities and agentic risk

Overview

This is a payment troubleshooting guide that asks for scoped, redacted diagnostic evidence and does not install code, run commands, or request secrets.

Install this only if you want Chinese-language Huifu/DouGong payment troubleshooting. When using it, redact keys, tokens, passwords, certificates, card or identity numbers, and other secrets before sharing logs or webhook payloads.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
当用户提供真实日志、要求可靠联调清单、需要上线验收标准，或第一轮诊断不确定时，读取 `references/diagnostic-playbook.md` 做更深入的案例处理。

## Non-Negotiable Safety Rules
- Never ask for private keys, full certificates, production passwords, access tokens, or raw secrets.
- If the user pasted a secret, stop using the value, tell them what looks sensitive, and recommend rotation.
- Do not invent real merchant values such as `sys_id`, `product_id`, `huifu_id`, `project_id`, `notify_url`, `sub_openid`, `buyer_id`, `auth_code`, or channel identifiers.
- Do not conclude "payment success" from a browser callback or page redirect alone.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill provides mandatory response text in Chinese and the document consistently instructs behavior through Chinese-only templates and examples, but does not state that language should follow the user's preference or offer an opt-in choice. That creates a natural-language locale policy concern because the skill appears to enforce a specific language by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill enables implicit invocation with no visible trigger constraints, exclusions, or scope limits, which can cause the agent to invoke this diagnostic skill in contexts the user did not clearly intend. While the skill appears focused on payment troubleshooting rather than direct code execution, it handles sensitive payment-debugging scenarios and may prompt collection or discussion of logs, webhook traces, merchant configuration, and transaction details, increasing the risk of unintended exposure or overreach.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The display name, short description, and default prompt are all written in Chinese, with no indication that users can choose another language or opt in to this locale. This may violate language or locale policy if the skill is expected to support users without forcing a specific language by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.