v1.0.0

好多素教需求单相关skill

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 6:09 AM.

Analysis

This instruction-only skill is coherent, but it can use a real production account to create, edit, approve, reject, close, transfer, export, or bulk-change business records.

GuidanceInstall only if you are authorized to operate this haoduo.vip production system. Treat the SMS code and logged-in session as sensitive account access, explicitly specify the environment and target records, and require confirmation before create/edit/submit/approve/reject/close/transfer/export or any bulk action.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

“默认使用正式环境，无需询问用户想要使用哪个环境” ... “已登录 ... 直接执行用户请求的操作” ... “编辑 / 提交审核 / 通过 / 驳回 / 关闭”

The skill defaults to production and instructs the agent to proceed directly when logged in, while also documenting actions that can materially change business records.

User impactThe agent could make real production changes such as submitting, approving, rejecting, or closing demand forms under the user's account.

RecommendationBefore any mutation, require explicit confirmation of the environment, record ID, intended action, and expected impact; document rollback or recovery steps for each high-impact action.

Cascading Failures

SeverityMediumConfidenceHighStatusNote

references/clue-list-page.md

“批量新建需求单” ... “批量更换负责人” ... “批量导入其他费用项” ... “导出”

The page guide documents bulk and export actions; they are not shown as automatic, but if invoked with the wrong filters or selections they could affect many records.

User impactA mistaken filter or selection could create, reassign, import fees for, or export many demand-form records at once.

RecommendationFor bulk or export actions, verify filters, record counts, and a sample of affected records, then ask for final user confirmation before proceeding.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

references/login-flow.md

“需要登录系统，请提供您的手机号” ... “请提供收到的短信验证码”

The login flow asks the user for a phone number and SMS verification code, allowing the agent/browser session to act with the user's CAS-authenticated privileges.

User impactProviding the SMS code gives the session access to the user's internal account and any permissions that account has.

RecommendationOnly provide the code in a trusted session, use the least-privileged account possible, and update metadata to clearly declare the CAS/OTP login requirement.