ClawHub
Back to skill

Security audit

Labor Dispute Check

Security checks for vulnerabilities and agentic risk

Overview

This is a China labor-dispute information and calculator skill with no evidence of hidden data access, network use, persistence, or unsafe installation behavior.

Install only if you want China labor-law estimate and evidence-preparation help. Treat outputs as informational, verify city/province-specific rules, and consult a qualified lawyer or labor bureau before relying on calculations or filing decisions. Avoid entering unnecessary sensitive employment details.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The example trigger "劳动纠纷咨询" is broad enough to capture generic labor-law consultations rather than the narrower calculator/evidence-prep use case described elsewhere. That can cause over-invocation of the skill, leading users to receive deterministic legal-style guidance in situations requiring nuance, which is risky in a legal domain even without malicious intent.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The skill emits labor-law guidance using China-specific rules such as the 'N+1' termination concept without requiring jurisdiction selection or clearly scoping the result to Chinese law before calculation. In a legal-rights estimation tool, this can mislead users in other jurisdictions into relying on incorrect legal advice, causing financial or legal harm even though the code itself is not an exploit vector.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The probation output encodes a jurisdiction-specific legal framework for contract and probation limits but does not ask the user to confirm that Chinese labor law applies. Because this skill is expressly marketed as checking labor disputes and estimating employee rights, the missing jurisdiction guard increases the chance that users treat a localized rule set as universally applicable.

Static analysis

No suspicious patterns detected.