ClawHub
Back to skill

Security audit

测试环境与数据

Security checks for vulnerabilities and agentic risk

Overview

This skill provides QA test-environment and test-data guidance with disclosed safeguards for non-production use.

Install this skill only for QA or test-environment work. Before following any restart, configuration, or data-cleanup guidance, confirm the exact target environment, verify it is not production, obtain approval, and ensure backups or a dry run are available.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The `when_to_use` field uses broad natural-language triggers such as '测试环境', '环境配置', and '测试数据', which can cause the skill to activate for loosely related requests without sufficient scoping. In this skill, over-triggering is more dangerous than usual because the content includes environment changes, restarts, configuration edits, and data cleanup guidance, so accidental invocation could steer an agent toward disruptive actions in the wrong context.

Static analysis

No suspicious patterns detected.