ClawHub
Back to skill

Security audit

Game Design Document CN

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese GDD-writing workflow that reads project design context and writes documentation only after user confirmation.

Install this if you want a Chinese-language, confirmation-driven workflow for drafting game system GDDs. Expect it to read nearby project design documents and ask before creating or editing files under the planning document structure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list contains broad generic phrases such as “GDD”, “系统拆解”, and “配置表设计”, which can plausibly appear in ordinary project conversations and unintentionally invoke the skill. Because the skill has write/edit capabilities and drives multi-step document workflows, accidental activation could lead to undesired file creation, edits, or disruptive prompting in unrelated contexts.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The metadata description states the skill produces Chinese GDD content, but there is no indication that language choice is gated by current user preference. This can cause the agent to answer in Chinese even when the surrounding session is in another language, creating usability and comprehension issues and increasing the chance of mistaken approvals for subsequent write actions.

Static analysis

No suspicious patterns detected.