ClawHub
Back to skill

Security audit

AI KEY·该投哪条线

Security checks for vulnerabilities and agentic risk

Overview

This skill is a business portfolio analysis guide that asks for relevant business metrics, gives recommendations, and does not execute external actions.

Install only if you are comfortable sharing revenue, resource allocation, and business-line details with the agent using this skill. Review the configured memory location and privacy mode first, because the skill can read prior AIKEY memory and write follow-up notes about portfolio judgments and commitments.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases include very broad natural-language requests such as 'which product should I focus on' and 'spread too thin', which can easily appear in ordinary conversation and cause unintended activation. In an agent setting, accidental invocation can expose prior context, steer the conversation into a specialized workflow the user did not request, or bypass user expectations about when the skill should engage.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
The skill mandates specific Chinese interaction conventions and output structure without indicating any user-language negotiation. This can cause the skill to override the user's language preference or accessibility needs, creating reliability and safety issues where the user may misunderstand recommendations or be unable to verify important business decisions.

Static analysis

No suspicious patterns detected.