ClawHub
Back to skill

Security audit

测试策略设计

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only QA planning skill that helps draft test strategy documents and does not show hidden, destructive, or data-exfiltration behavior.

Before installing, note that it may trigger on broad QA planning language and that the referenced full QA skill set would be a separate install. Treat its CI/CD and release references as planning guidance only, not permission to change pipelines or release processes.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases in `when_to_use` are broad and overlap with common conversation such as “测试计划”, “方案设计”, and “怎么测”, which can cause the skill to activate outside its intended context. In an agent system, over-broad activation can route user input into the wrong workflow, producing irrelevant outputs or interfering with more appropriate skills.

Static analysis

No suspicious patterns detected.