ClawHub
Back to skill

Security audit

Chatmosp Parameter Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a purpose-aligned ChatMOSP parameter-building skill with some confusing language-file labels but no evidence of malware, credential access, persistence, or hidden data theft.

Reasonable to install for ChatMOSP MSR/KMC parameter preparation. Before relying on it, review the language-routing text and be aware that missing parameters may trigger companion literature lookup and generated simulation files after confirmation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The language-routing block is internally inconsistent: in the Chinese file it tells English users to read `SKILL_cn.md` in the same directory while also treating this file as authoritative for Chinese users, creating ambiguity about which document governs behavior. In a multi-file skill, ambiguous authority can cause the agent to follow the wrong instruction set, bypass safeguards, or produce unintended behavior without explicit user consent.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The skill instructs generating task directories and multiple output files but does not clearly disclose that it may create or modify filesystem artifacts. This can lead to unexpected local side effects, especially in agent environments where users may assume analysis is read-only unless warned otherwise.

Missing User Warnings

Low
Confidence
74% confidence
Finding
The skill directs the agent to call a literature-search skill when parameters are missing, but does not warn that this may transmit user/task data to another component or external networked source. Even if the data is not highly sensitive, undisclosed cross-skill or network transfer reduces transparency and can create privacy and compliance issues.

Static analysis

No suspicious patterns detected.