ClawHub
Back to skill

Security audit

ceo-indotrading

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow Indonesian-language business-analysis skill with no executable code, persistence, credential handling, or hidden data movement.

Install only if you want an Indonesian-language assistant for IndoTrading business analysis. Provide data sources deliberately, especially finance, dashboard, API, spreadsheet, or database data, and treat its recommendations as analysis to review before taking business action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The skill hard-codes that responses must be in Bahasa Indonesia, which can override or conflict with the user's language preference and reduce transparency or usability for users expecting another language. While this is not a code-execution or data-exfiltration issue, it can create a safety and trust problem if important business analysis is delivered in a language the user did not request or fully understand.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
This markdown file uses Indonesian throughout the operational guidance, which can amount to a language/locale policy issue when the skill implicitly forces one language for all users. There is no indication that the skill is region-specific or that users may opt into Indonesian.

Static analysis

No suspicious patterns detected.