ClawHub
Back to skill

Security audit

Credit Review Digital Employee

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable credit-review workflow guide that handles sensitive banking context but clearly limits itself to draft analysis with human review and no tool access.

Before installing, treat this as a Chinese credit-review drafting aid, not an automated banking connector. Only provide desensitized, authorized materials in chat, and keep any system queries, saving, archiving, or external sending inside your institution’s approved systems and human approval process.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Module 6 declares data sources such as customer notes and note-reading interfaces, despite the global boundary statements saying the skill has no tool, system, query, or note-access capability. In a credit-review context handling highly sensitive customer and financial data, this contradiction can cause unsafe deployment assumptions, leading operators or wrapper code to grant unnecessary access to internal records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The workflow instructs the skill to check for and read customer-note content, directly contradicting the document's repeated claim that the skill cannot query systems or note interfaces. This creates a dangerous specification gap: implementers may wire the skill to internal note systems to satisfy the workflow, exposing confidential banking records and enabling unauthorized data access under the guise of normal operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest description is presented exclusively in Chinese, which can impose a language choice on users who may not read that language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The audit-trail example includes a persistence-oriented field (report_saved: true) that conflicts with repeated claims that the skill does not save reports or participate in persistence. This kind of contradictory guidance can mislead downstream integrators or operators into assuming the skill is allowed to trigger or represent storage actions, weakening trust boundaries around sensitive financial and customer data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.