ClawHub
Back to skill

Security audit

胡田 OPC导师 TRIZ强化

Security checks for vulnerabilities and agentic risk

Overview

This skill is a TRIZ innovation guidance package with disclosed web and reference-file research workflows and no hidden executable behavior found.

Install if you want a TRIZ innovation assistant that can use web research for papers, patents, and technology trends. Use explicit prompts before starting scans or switching into patent/IP-related workflows, and treat patent or IP outputs as planning guidance rather than legal advice.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill can be activated from an extremely broad trigger ('just provide a domain keyword'), which increases the chance of unintended invocation and tool-enabled overreach. In this skill, that broad entry point is more concerning because allowed tools include web search, browser use, and file operations, so a vague prompt could cause the agent to perform unnecessary discovery or pivot into adjacent workflows without clear user intent.

Vague Triggers

Low
Confidence
80% confidence
Finding
Using a bare numeric trigger like 'reply with a number to enter the corresponding skill' is ambiguous and can overlap with ordinary conversation, causing accidental cross-skill activation. The impact is limited, but in a multi-skill environment it can steer users into unintended flows such as patent search or IP operations, especially when combined with permissive activation logic elsewhere in the skill.

Vague Triggers

Low
Confidence
81% confidence
Finding
The follow-up prompt repeats the same ambiguous numeric activation pattern without context binding, so ordinary replies like '1' or '2' may trigger navigation unexpectedly. This is a genuine workflow safety issue because it reduces intent verification and can chain into other skill actions that the user did not clearly request.

Static analysis

No suspicious patterns detected.