ClawHub
Back to skill

Security audit

Cb Product Market Fit Validator

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a descriptive market-validation skill, but one included scenario recommends exchanging Amazon samples for reviews, which creates a real platform-policy and ethical risk.

Review the ecommerce scenario before installing or using this skill. The framework itself is low-risk and non-executable, but users should remove or ignore any advice about exchanging products for reviews and keep validation methods compliant with marketplace, advertising, and local legal rules.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The skill repeatedly claims it is 'pure descriptive' and avoids external actions, but the Chinese usage scenario instructs users to search live third-party platforms, analyze marketplace/social/video data, and explicitly suggests sending free Amazon samples in exchange for reviews. That creates a dangerous mismatch between declared safety boundaries and actual guidance, and the review-generation tactic can facilitate platform-policy violations, deceptive marketing, or incentivized review abuse.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This scenario goes beyond neutral market-validation planning into concrete gray-area growth tactics, including platform-specific probing and incentivized review acquisition. In the context of a business-expansion skill, that makes the content more dangerous because users may treat these tactics as endorsed operational playbooks rather than hypothetical examples, increasing the risk of policy violations, account sanctions, and unethical market manipulation.

Static analysis

No suspicious patterns detected.