ClawHub
Back to skill

Security audit

Hutian Opc Pre Publish Check

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language pre-release checklist skill made of Markdown guidance and templates, with no executable code or hidden high-risk behavior found.

Install this if you want a Chinese OPC-oriented checklist for reviewing a Skill or Agent before release. Non-Chinese users or teams outside the OPC workflow may need to translate or adapt the templates, and any optional integrations that update IP or management records should be reviewed separately before granting write access.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata and description are written entirely in Chinese and present the skill as a standardized release tool for a Chinese-language workflow without any indication that other languages are supported. In a multi-tenant agent platform, forcing a language/locale without user opt-in can mislead users, degrade review quality, and cause compliance or publishing decisions to be made from misunderstood instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The applicability statement limits the skill to '胡田-OPC导师体系下的所有Skill/Agent', which ties operation to a specific organizational context without explaining why that restriction is required. This can create unfair or confusing behavior on a general-purpose platform and may cause users outside that context to receive unsuitable guidance while assuming the checklist is universally applicable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The file is written entirely in Chinese and states at L308 that it 'must' be used before each Skill release, but it does not offer a language choice or explain a region-specific requirement. This creates a natural-language locale constraint that could force a specific language on users or contributors without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该文件全文仅以中文编写，且未说明这是面向特定中文团队、地区或合规场景的限定文档。根据语言/区域策略，若技能或流程文档隐含强制特定语言而无用户选择或明确正当理由，属于自然语言层面的政策风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

文件标题及全文均以中文撰写本身不构成问题，但该手册作为通用“Skill/Agent”审核规范，未说明语言适用范围，也未提供用户可选择其他语言的机制。按照语言/区域政策，若规范实际要求统一使用特定语言而无用户选择或合理限定，可能构成自然语言政策违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file is written entirely in Chinese and states the template must be completed before each skill release, which makes the prescribed workflow effectively Chinese-only. There is no indication that users may choose another language or locale, nor any justification that the template is limited to a Chinese-only compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions, templates, and usage guidance only in Chinese, with no opt-in, alternative language option, or stated region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

该文档全文以中文编写，并在“每个Skill发布前必须执行”处使用强制性措辞，可能构成默认要求所有使用者遵循中文文档流程。根据规则，若技能或流程强制特定语言/locale而无用户选择或明确合理限定，可视为自然语言政策问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.