ClawHub
Back to skill

Security audit

技能升级巧匠

Security checks for vulnerabilities and agentic risk

Overview

This skill is a prompt and skill-improvement guide with no code execution, persistence, credential access, or hidden data handling.

Install this if you want a Chinese-language workflow for improving AI prompts or skill drafts. Review its style expectations first, especially the structured intake process and Chinese typography rules, because they may be too rigid for quick edits or non-Chinese outputs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions are broad enough to match common requests like optimizing prompts or evaluating skills, which can cause the agent to invoke this skill in situations where the user did not explicitly ask for meta-level prompt engineering. Over-broad invocation increases the chance of misrouting, unexpected behavior, and accidental interception of normal user tasks, especially because the skill then imposes a rigid multi-step workflow before helping.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The skill hard-requires Chinese typography and formatting conventions without checking the user's language or presentation preference. This can override user intent, degrade usability in multilingual contexts, and create unsafe or policy-conflicting transformations when the original material must remain language-faithful or platform-compatible.

Static analysis

No suspicious patterns detected.