Yijuhua Chufangan

AdvisoryAudited by Static analysis on May 5, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Generated proposals may look ready to use but can contain invented metrics, budgets, or responsible parties.

Why it was flagged

The helper fills proposals with default budgets, phase amounts, names, and other concrete values when the user has not provided them.

Skill content

entities['{total_budget}'] = '1200' ... entities['{phase1_budget}'] = '300' ... entities['{pm_name}'] = '张经理'

Recommendation

Treat outputs as drafts and verify all figures, names, policy references, budgets, timelines, and performance targets before using them.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

Running the helper executes local Python code and may create or overwrite an output file if the user chooses an existing path.

Why it was flagged

The skill documents an optional local Python CLI that can generate and save a proposal file to a user-chosen path.

Skill content

python references/yijuhua.py "新产品上市方案" --output ./方案.md

Recommendation

Use the CLI only when you intend to run local code, and choose output paths carefully.