ClawHub
Back to skill

Security audit

AI日报测试版

Security checks for vulnerabilities and agentic risk

Overview

This is a simple instruction-only skill for generating Chinese AI news digests and does not request credentials, local file access, installs, persistence, or privileged actions.

This skill is reasonable to install for Chinese AI news summaries. Before relying on outputs, verify timestamps and source links because daily-news skills can become stale or cite weak sources, and specify your preferred language if you do not want a Chinese digest.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill’s activation criteria are overly broad, instructing use not only for explicit 'AI daily/news' requests but also for vague requests to summarize recent AI progress. This can cause the skill to trigger in contexts the user did not intend, leading to inappropriate tool use, incorrect routing, or unnecessary web retrieval based on weak intent signals.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The skill mandates Chinese terminology/outputs without giving the user a language choice or documenting that the skill is intentionally Chinese-only. While not a direct security exploit, this can override user preference and cause incorrect or misleading behavior in multilingual contexts, especially if the agent applies the skill to users expecting English or another language.

Static analysis

No suspicious patterns detected.