ClawHub
Back to skill

Security audit

Yuan Dian

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Yuan Dian connector skill for legal and enterprise data lookups, with only minor routing and third-party data-use cautions.

Install this if you intend to use Yuan Dian through an OOMOL-connected account. Before using it, consider whether the legal text, enterprise records, or due-diligence queries you submit are appropriate to send to that external service, and review any oo CLI install or billing steps before running them.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrase instructs the agent to use this skill for 'ANY Yuan Dian request,' which is overly broad and can cause the skill to be invoked for loosely related tasks without adequate user intent validation. In a connector-backed skill that can access external legal and enterprise data, over-triggering increases the chance of unnecessary data access, provider lock-in, and accidental execution in contexts where a different tool or no tool should be used.

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
The documentation mandates use of this provider for any related task and does not present alternatives or user choice, which can create policy and consent issues, especially where jurisdiction, privacy, or cost considerations matter. While not directly enabling code execution or privilege escalation, it can steer agents into unnecessary third-party data access and reduce transparency about provider selection.

Static analysis

No suspicious patterns detected.