ClawHub
Back to skill

Security audit

每日早报

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward daily-brief skill that fetches public weather and V2EX hot-post data, with no hidden install code or sensitive access.

Install this if you want an agent to contact wttr.in and v2ex.com for a daily brief. Enable the 8:00 AM scheduled run only intentionally, and consider narrowing or confirming the "今天怎么样" trigger if accidental brief generation would be unwelcome.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrase "今天怎么样" is broad enough to match ordinary small-talk rather than a clear request for this specific briefing skill. In an agent setting, this can cause unintended skill invocation, unexpected external network calls, and responses that override the user’s actual conversational intent.

Static analysis

No suspicious patterns detected.