ClawHub
Back to skill

Security audit

个人建站创业助手

Security checks for vulnerabilities and agentic risk

Overview

This is a simple website-building guidance skill with no executable code, persistence, or hidden privileged behavior.

Before installing, treat this as general website-building guidance rather than legal, tax, benefits, or privacy advice. Review terms and data practices for any analytics, ad, API, hosting, or form provider before adding them to a real site.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README’s title, description, audience, and usage examples are all written in Chinese, which imposes a specific language on users without stating that the skill is Chinese-only or offering an alternative language. The policy explicitly calls for flagging language or locale constraints when they are forced without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill recommends analytics and third-party integrations such as Google Analytics, Baidu Tongji, APIs, and form services without warning that these tools may collect, transmit, or expose user data to external providers. In a beginner-oriented website-building skill, this omission can lead users to deploy tracking or data-sharing components without understanding consent, privacy notice, cross-border transfer, or regulatory implications.

Content

No source excerpt is available for this finding.