ClawHub
Back to skill

Security audit

Zhangyiming Think Partner

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a low-risk advisory skill whose main concerns are broad triggering and a Chinese-language default, not hidden or harmful behavior.

Install only if you want a strategy/reflection framework and are comfortable with Chinese as the default language. For financial, legal, medical, or other regulated decisions, use it only for general brainstorming and seek qualified advice before acting.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill's activation triggers are very broad and cover open-ended decision, management, product, and investment-style questions without strong boundaries or exclusion criteria. This can cause the agent to invoke the persona-based framework in contexts where it is poorly suited, leading to over-application of stylized advice, misrouting, or inappropriate guidance in higher-risk domains such as finance, entrepreneurship, or organizational decisions.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
The skill specifies Chinese as the primary language without indicating that the user can choose another language. This can create usability and consent issues by overriding user preference, and in multilingual settings it may reduce clarity or increase the chance of misunderstanding important advice.

Static analysis

No suspicious patterns detected.