ClawHub
Back to skill

Security audit

法律检索助手

Security checks across malware telemetry and agentic risk

Overview

This is a small Chinese legal-research helper with no executable code, network behavior, persistence, or credential access found.

Install only if you want a Chinese-language legal-reference helper. Treat its legal outputs as general research, verify citations and jurisdiction-specific rules independently, and note that the artifact includes self-asserted CLEAN/verified claims and consulting contact information rather than executable retrieval logic.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger list includes broad phrases such as '查法律', '找法规', and '法律依据' that are likely to overlap with ordinary user requests, increasing the chance of unintended or excessive activation. In a legal-assistant context this can cause the skill to intercept requests outside its intended scope, potentially steering users into automated legal guidance when they did not explicitly request this tool.

Natural-Language Policy Violations

Medium
Confidence
74% confidence
Finding
The description is written as Chinese-only behavior without indicating user choice, fallback behavior, or a justified locale restriction. This can lead to mismatched handling of user requests, reduced transparency, and incorrect assumptions about language preference, which is especially risky in legal contexts where precision and user comprehension matter.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.