ClawHub
Back to skill

Security audit

技能优化器

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly meant to edit other installed skills, but its broad triggers and limited pre-write control make it worth a careful review before installing.

Install only if you want an agent helper that can modify your existing skills. Before using it, require an explicit target skill, review a proposed diff before any write, and keep backups or version control for your skills directory.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list contains broad natural-language phrases such as “技能有问题”, “改进技能”, and “技能缺少”, which are likely to appear in normal discussion and can cause unintended invocation. In this skill’s context, accidental activation is more dangerous because the skill is designed to modify other skills, so a false trigger could lead to unauthorized or harmful changes to agent behavior or prompts.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger set is broad and overlaps with ordinary conversation about improving or discussing skills, making accidental invocation likely. Because this skill is designed to modify other skills, an unintended activation could cause unauthorized or unnecessary changes to prompts, workflows, or safety rules, amplifying downstream risk.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger guidance encourages broad phrases such as “修改技能” and “技能有问题,” which are common in ordinary conversation and can cause the skill to activate unintentionally. In a skill that edits or optimizes other skills, accidental invocation increases the chance of unauthorized prompt changes, workflow drift, or adversarial redirection through normal-looking user text.

Static analysis

No suspicious patterns detected.