ClawHub
Back to skill

Security audit

招投标全景透视

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Cue-powered bidding research helper that sends searches to Cue and external public bidding data sources, with no evidence of hidden local execution or destructive behavior.

Install only if you are comfortable sending bidding search queries, company names, competitor names, and related metadata to Cue's service and its public bidding-data integrations. Avoid entering confidential procurement plans, private target lists, or non-public business intelligence unless Cue's data handling terms meet your requirements.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly sends user queries and authentication data to Cue's external service and relies on third-party bidding data providers, but it does not present a clear user-facing warning in the description or upfront safety notice about external data transmission. This can lead users to unknowingly submit sensitive business intelligence, target lists, or competitive monitoring terms to external systems, creating confidentiality and privacy risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.