ClawHub
Back to skill

Security audit

木工厂报价助手

Security checks for vulnerabilities and agentic risk

Overview

This woodworking quotation skill does local cost calculation and Excel export as advertised, with only minor caution around broad trigger words and internal pricing data.

Before installing, review and customize the pricing, loss-rate, profit-margin, and branding/contact details. Use the internal pricing mode only in a trusted workspace, and confirm the intended drawing and output file before exporting quotation spreadsheets.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrase "算报价" is very generic and can easily appear in normal user conversation about estimating prices, causing the skill to activate unintentionally. In a skill that processes uploaded drawings and may export pricing sheets, accidental invocation can expose internal costing logic or trigger actions on sensitive business files without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The guidance lists broad trigger words and basic steps but does not define boundaries, required context, or negative examples, so the agent may invoke the skill from ambiguous requests. Because this skill handles drawings, pricing logic, and potentially internal/external modes, unclear invocation rules increase the chance of unintended access to sensitive cost data or incorrect automated processing.

Static analysis

No suspicious patterns detected.