ClawHub
Back to skill

Security audit

聘才猫（Pincaimao）劳动合同卫士

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to analyze labor contracts by sending them to a third-party API, which is purpose-aligned but sensitive enough to require careful review.

Install only if you are comfortable sending labor contracts or pasted contract text to api.pincaimao.com. Redact personal, salary, address, and confidential business terms where possible, verify the provider's retention and deletion policies, and avoid using it for contracts you are not allowed to share with external services.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
CONTRACT_FILE="/path/to/contract.docx"

# Step 1: 上传合同文件
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_LABOR_CONTRACT_KEY" \
  -F "file=@${CONTRACT_FILE}")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")
Confidence
95% confidence
Finding
This skill uploads a labor contract file to an external third-party API endpoint, which transmits potentially highly sensitive personal and employment data outside the local environment. Even if this is the intended feature, it creates real confidentiality and privacy exposure because contract contents and metadata leave the user's system and are stored on the provider's cloud storage.

External Transmission

Medium
Category
Data Exfiltration
Content
'response_mode': 'blocking'
}).encode()
req = urllib.request.Request(
    'https://api.pincaimao.com/agents/v1/chat/chat-messages',
    data=payload,
    headers={'Authorization': f'Bearer {key}', 'Content-Type': 'application/json'}
)
Confidence
94% confidence
Finding
The skill sends contract analysis payloads to an external API endpoint, including either uploaded file references or contract text, which exposes sensitive employment and personal information to a third party. In this skill's context, external transmission is core functionality, but it is still a genuine security/privacy concern because the data is not processed locally.

External Transmission

Medium
Category
Data Exfiltration
Content
'response_mode': 'blocking'
}).encode()
req = urllib.request.Request(
    'https://api.pincaimao.com/agents/v1/chat/chat-messages',
    data=payload,
    headers={'Authorization': f'Bearer {key}', 'Content-Type': 'application/json'}
)
Confidence
94% confidence
Finding
Directly sending pasted contract text to the external API can disclose confidential terms, salary details, identities, addresses, and other sensitive labor information. The danger is elevated by the document type: labor contracts often contain personal and regulated data, so third-party transmission has meaningful privacy and compliance implications.

Static analysis

No suspicious patterns detected.