ClawHub
Back to skill

Security audit

测试场景树

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only QA skill for generating test scenario trees, with minor routing and language-fit caveats but no harmful behavior.

Before installing, be aware that this skill is designed for Chinese QA workflows and may trigger on general test-scenario requests. Avoid pasting real customer, payment, identity, or production data unless it has been masked.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation phrases are broad enough to match common QA/testing requests, which can cause the skill to trigger when the user did not specifically intend to use scenario-tree generation. In an agent system, this can lead to incorrect routing, unnecessary context injection, and reduced reliability of downstream actions, especially because the skill prescribes a fairly opinionated workflow.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The skill metadata and body are written to enforce Chinese-language interaction without any indication of fallback or user-language negotiation. This can cause misalignment with user intent, misrouting in multilingual environments, and errors in generated outputs when the user or surrounding workflow expects another language.

Static analysis

No suspicious patterns detected.