ClawHub
Back to skill

Security audit

Insurance Solvency Reporter

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only China insurance solvency reporting skill with disclosed manual-review and data-minimization safeguards, though users should confirm the jurisdiction and current rules before relying on it.

Use this only for Chinese insurance C-ROSS/NFRA solvency work. Do not provide raw customer lists, full policy-level data, or unnecessary sensitive ledgers, and have qualified actuarial, finance, or compliance staff verify all figures and current regulatory requirements before using any generated report.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill uses very broad trigger keywords such as general solvency, capital adequacy, regulatory reporting, and related Chinese terms without defining exclusion conditions or requiring explicit user confirmation of the China insurance/C-ROSS context. This can cause unintended activation in adjacent finance, compliance, or insurance conversations, leading the agent to provide domain-specific regulatory calculations or reporting guidance in the wrong context and increasing the chance of incorrect compliance output.

Static analysis

No suspicious patterns detected.