ClawHub
Back to skill

Security audit

product-ux-workflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a UX workflow checklist and handoff template, with no code execution, data access, persistence, or hidden behavior.

This looks safe to install as a methodology skill for product UX planning. Users should expect it to push structured UX deliverables and strict handoff documentation, but it does not appear to run commands or access private data.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
The description includes Chinese keywords alongside English content, which introduces a language-specific element in the skill's natural-language interface. Because the file does not state that multilingual behavior is optional or user-selected, this may conflict with a policy requiring language/locale choice rather than implicit enforcement.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The prompt text is written entirely in Chinese, which indicates a specific language requirement for this evaluation item. The file does not provide any indication that language selection is optional or user-driven, so this can be read as a locale/language constraint without opt-in.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
This JSON eval file contains a natural-language prompt written in Chinese, while the rest of the evaluation content is in English, suggesting the skill is expected to handle or possibly default to a specific language context. Because the file provides no explicit language-selection mechanism or justification for the locale constraint, it may violate the language/locale policy requirement.

Static analysis

No suspicious patterns detected.