ClawHub
Back to skill

Security audit

胡田 OPC导师 AI自动化工作流

Security checks for vulnerabilities and agentic risk

Overview

This is a guidance-only Chinese-language skill for one-person-company AI workflow planning, with no executable code or hidden privileged behavior found.

Install this if you want Chinese-language guidance for OPC AI automation planning. Be aware it may activate for general productivity or tool-selection questions, so users who want narrower behavior should refine the trigger wording or request another output language explicitly.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad and overlap with common productivity or tooling questions, making the skill likely to activate outside its intended OPC automation scope. This can cause misrouting, irrelevant automation advice, and unintended invocation in ordinary conversations, which is a real security/safety concern in agent routing even without direct code execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该技能文档整体以中文命名和编写，但未说明这是面向特定中文用户群体的限定，也未向用户提供语言/locale 选择。按照语言/locale 政策，若技能默认强制单一语言而没有用户选择或合理地域性说明，属于自然语言策略风险。

Content

No source excerpt is available for this finding.