ClawHub
Back to skill

Security audit

我要退休

Security checks for vulnerabilities and agentic risk

Overview

This is a local China retirement and social-insurance calculator whose requested personal and salary details fit its stated purpose.

Install this only if you want a mainland-China retirement and social-insurance estimator. It will ask for personal and salary information, so use approximate values when possible, confirm the jurisdiction before proceeding, and verify any result against current local official rules rather than treating it as legal, financial, or benefits advice.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are broad enough to match common retirement or planning questions, which can cause the skill to activate in situations where the user did not explicitly ask for this specialized workflow. That increases the chance of unnecessary collection of sensitive personal and financial data such as birth date, salary, city, and employment status.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The skill is hard-scoped to Chinese users and Chinese-language phrasing without a documented locale gate or user choice, which can lead to inappropriate activation for users in other locales or language contexts. In this case the impact is mostly misrouting and misleading policy calculations rather than direct compromise, but it can still produce incorrect financial guidance for the wrong audience.

Static analysis

No suspicious patterns detected.