ClawHub
Back to skill

Security audit

输出验证

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed QA checklist for validating generated test cases and does not request risky execution, persistence, or data access.

Install this if you want a Chinese-language final validation checklist for AI-generated test cases. Be aware that it may activate on broad quality-check phrasing, and review the separate QA Test Skills bundle before installing it because that bundle was not part of this inspection.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation conditions are very broad, including common phrases like '验证一下输出' and '确认一下质量', which can cause the skill to trigger in contexts where the user did not explicitly request this specialized validation workflow. That can lead to unintended interception of normal conversation, incorrect workflow routing, and suppression or delay of the intended task output.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The skill is authored entirely in Chinese and its operational/output requirements are also Chinese-specific, without stating a locale restriction or offering language negotiation. In a multilingual environment this can cause the agent to produce outputs the user cannot verify, misinterpret instructions, or fail to apply the validation process correctly, undermining reliability and potentially hiding quality or safety issues.

Static analysis

No suspicious patterns detected.