ClawHub
Back to skill

Security audit

外贸出口检测与单证合规助手

Security checks across malware telemetry and agentic risk

Overview

This is a coherent trade-document and export-compliance assistant, with the main caution that one HS-code helper may send the search term to an external placeholder API.

Install only if you are comfortable using it for preliminary trade-document review. Treat outputs as drafts, verify regulations with official sources or professionals, and avoid running the online HS lookup with sensitive product or shipment descriptions unless you accept that the query may be sent externally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill explicitly references reading local reference files and invoking helper scripts including a network-enabled HS lookup, yet no permissions are declared. That mismatch can bypass least-privilege expectations, making file access and outbound lookups occur without clear user or platform visibility, which is risky in a document-heavy skill that may process sensitive trade data.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes broad generic terms such as 检测, 合规, 单证, 外贸, 出口, and 报关, which can cause the skill to activate in many unrelated conversations. Over-broad invocation increases the chance that unrelated user content or sensitive commercial documents are pulled into this workflow, potentially leading to unnecessary file reads, analysis, or external lookups.

External Transmission

Medium
Category
Data Exfiltration
Content
"""联网查询（调用腾邦HS编码查询API示例）"""
    try:
        # 注意：实际使用时请替换为可用的HS编码查询API
        url = f"https://api.example.com/hs/search?q={keyword}"
        resp = requests.get(url, timeout=5)
        if resp.status_code == 200:
            return resp.json()
Confidence
83% confidence
Finding
https://api.example.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.