ClawHub
Back to skill

Security audit

Korean Business Email

Security checks for vulnerabilities and agentic risk

Overview

This skill is a static Korean business email template with no code, network access, credential handling, or persistence; the main caveat is broad and somewhat malformed activation wording.

Install only if you want Korean business email drafting help. When writing for a non-Korean or multilingual audience, tell the agent the desired language, tone, and recipient context so it does not apply Korean business conventions unnecessarily.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is scoped so broadly that it may activate for essentially any request involving Korean business email, without clear boundaries, exclusions, or user-confirmation conditions. This can cause the agent to over-apply the skill in contexts where the user did not explicitly want Korean-language or Korea-specific business formatting, increasing the risk of incorrect, inappropriate, or policy-conflicting output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill description appears to impose Korean language and Korean business-culture conventions by default, without stating that this behavior is optional or user-directed. While not directly enabling code execution or data exfiltration, it can override user preference, produce mismatched communications, and lead to unsafe or inappropriate automation in multilingual or cross-cultural contexts.

Content

No source excerpt is available for this finding.