ClawHub
Back to skill

Security audit

Compliance Scan Report

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward compliance-reporting skill that reads user-scoped code to identify privacy and security compliance issues, with no executable payload, persistence, or hidden data handling found.

Install this if you want a Chinese-language compliance self-check helper for code repositories. Confirm the scan scope before use and do not treat the output as a substitute for legal advice or a formal compliance audit.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description and operating instructions are Chinese-only and do not indicate language negotiation, which can lead to misunderstood outputs, missed warnings, or user inability to validate findings and remediation. In a compliance context, clarity matters because users may act on the report for audit preparation or privacy remediation, so language mismatch can reduce safe and correct use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions are broad enough to activate on generic security, privacy, audit, or compliance-related requests, which can cause this skill to hijack user intent and run when a more appropriate specialized skill should handle the task. In an agent environment, overbroad routing increases the chance of incorrect tool selection, unnecessary repository scanning, and disclosure of more code or data than the user intended for this specific workflow.

Content

No source excerpt is available for this finding.