ClawHub
Back to skill

Security audit

color-system

Security checks for vulnerabilities and agentic risk

Overview

This skill provides color palette, CSS token, and print color guidance without hidden execution, credential access, persistence, or unrelated authority.

This skill is reasonable to install for generating UI color tokens and print color specifications. Users should treat its CMYK/Pantone values as design guidance and verify final print specs with their printer or production workflow.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Low
Confidence
81% confidence
Finding
This is a JSON manifest-like file, so vague-trigger review applies. The prompt text is a generic instruction to generate a design artifact and does not document any activation boundary, exclusion condition, or narrower invocation scope, which could overlap with ordinary user requests for color guidance.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
The file includes an eval prompt in Chinese while other entries are in English, but there is no accompanying statement that language should follow user preference or that multilingual behavior is intentional. This can indicate an implicit language/locale policy issue because the skill behavior around language selection is not documented.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
This JSON file contains a natural-language prompt in Chinese, while the surrounding evaluation content is otherwise in English. Because SQP-3 applies to all file types and covers language/locale policy issues, this can be read as embedding a language-specific requirement without documenting user choice or opt-in.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
Lines L47-L50 include Chinese-only terminology in parentheses such as '铜版纸', '双胶纸/道林纸', and '牛皮纸/瓦楞纸', and similar bilingual sector labels also appear later. The file does not state that the skill is China-market-specific or offer users a language/locale option, which can conflict with language/locale policy expectations.

Static analysis

No suspicious patterns detected.