ClawHub
Back to skill

Security audit

CB Brand Naming Trademark Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a descriptive brand-naming guide with clear legal and availability limitations, though some examples still overstate what it can verify.

Safe to install as a naming framework. Do not rely on it as legal clearance or live availability checking: provide dated results from USPTO, EUIPO, WIPO, KIPRIS, registrars, or handle searches if you want it to summarize evidence, and use qualified trademark counsel before adopting a commercial name.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill metadata promises preliminary trademark and domain availability screening, but the README states the skill only provides evaluation frameworks and explicitly does not perform trademark search or legal clearance. This mismatch can mislead users into relying on nonexistent screening, increasing the chance of adopting names that infringe trademarks or create avoidable legal and business risk.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill’s examples and expected outputs repeatedly imply live trademark, domain, social-handle, and SEO checks, even though the skill explicitly states it cannot perform those checks without user-supplied authoritative data. This creates a strong risk that an agent following the examples will fabricate or overstate availability results, causing users to rely on false legal or commercial screening information.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The Chinese-language scenario presents a Chinese input and a Chinese expected output without stating that language choice should follow the user’s preference. In multilingual agent environments, this can lead to unexpected language switching, user confusion, or mishandling of downstream instructions and review, especially when legal-risk content must be clearly understood.

Static analysis

No suspicious patterns detected.