ClawHub
Back to skill

Security audit

仓配网络优化器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local warehouse-network optimizer that reads logistics spreadsheets/JSON files and writes expected JSON and Excel reports.

Install in a virtual environment, run it only on spreadsheets you intend to process, and choose an empty working folder or explicit unique output filenames. The main practical risks are normal local processing risks: overwriting reports, exposing sensitive business data in generated files, and solver resource use on large datasets.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
83% confidence
Finding
The skill instructs users to run conversion and optimization commands that create JSON and Excel outputs in the working directory, but it does not clearly warn that existing files may be overwritten. This is not an arbitrary file-write exploit by itself, but it can lead to accidental data loss or unintended modification of local files when users run the documented commands in sensitive directories.

Static analysis

No suspicious patterns detected.