ClawHub
Back to skill

Security audit

企业全景画像

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Cue-based enterprise due-diligence workflow, with the main cautions being third-party API processing and local report storage.

Install only if you are comfortable sending target company queries to Cue and storing generated due-diligence reports locally. Avoid entering confidential transaction strategy, private customer data, or non-public financial details unless your organization approves that use of Cue and the selected storage path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs writing generated due-diligence reports to local files under ~/cue-reports without explicitly warning that the output may contain sensitive business intelligence or personal/company data. This can lead to unintentional persistence of sensitive material on shared machines, backups, or synced folders.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that user queries and processing go through Cue API and external data sources, but it does not clearly warn users that their input will be transmitted to third-party services. In a due-diligence context, users may submit confidential target names, transaction interests, or internal investigative angles, creating confidentiality and compliance risks.

Static analysis

No suspicious patterns detected.