ClawHub
Back to skill

Security audit

China Electronic Components Suppliers

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local supplier and industry reference guide with no evidence of network access, persistence, credential use, or unsafe agent instructions.

Install this as a reference-data skill, not as a verified procurement authority. Be aware that the bundled data includes company-level contact emails and capacity claims despite the skill text saying otherwise, so verify supplier identities, certifications, and contacts independently before acting on sourcing recommendations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation says users can interact with the skill using natural language, but it does not define specific trigger phrases, scope limits, or negative examples. This broad phrasing can overlap with ordinary conversational requests and make it unclear when the skill should activate versus when it should not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
64% confidence
Finding

The skill is positioned for international users, but the file does not state whether responses can adapt to the user's preferred language or locale. For a globally targeted skill, lack of any language-choice or opt-in language behavior can create a policy concern if the implementation assumes a fixed language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest describes a guide covering manufacturing clusters, supply chain structure, regional specializations, and industry trends for international buyers. The factories section goes further by providing individual company contact emails and operational capacity data, which shifts the file from high-level industry guidance into a direct supplier directory. While related to buyers, this is broader and more operational than the stated description implies.

Content

No source excerpt is available for this finding.