ClawHub
Back to skill

Security audit

Security Intelligent Cs

Security checks for vulnerabilities and agentic risk

Overview

This is a static banking customer-service prompt/template with no executable code or hidden installation behavior, but it should not be treated as a real ticketing or account system by itself.

Before installing, treat this as a script and knowledge-template skill only. Do not use it as production banking support unless you connect it to real identity verification, ticketing, audit, and notification systems, and ensure agents do not invent ticket numbers or collect sensitive customer details outside approved processes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes generic phrases such as "chatbot," "FAQ," "complaint handling," and Chinese terms like "银行服务" and "账户查询," which could appear in ordinary discussion rather than a clear invocation. The file does not provide constraints, activation boundaries, or negative examples to distinguish when the skill should activate versus when these terms are merely being discussed.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The phrase "中文触发词（优先）" indicates a preferred language for activation, which is a language-policy constraint expressed in natural language. Although the document is bilingual, it does not explicitly give users a choice or state that the language preference is optional.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The SOP text tells users that progress updates will be sent immediately and that a follow-up person/contact and ticket number exist, but the skill only contains static template text and no implementation for creating tickets or sending notifications. In a financial customer-service context, this can mislead customers into believing a complaint is being tracked or escalated when no such workflow exists, causing delayed response and compliance or customer-harm issues.

Static analysis

No suspicious patterns detected.