ClawHub
Back to skill

Security audit

geo-optimization-cn

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed business-content helper, but users should review and redact company documents before copying generated prompts into Claude.

Install only if you are comfortable running local Python document tools and manually using Claude for generated prompts. Before pasting any prompt into an external AI service, review and redact confidential business information, personal data, trade secrets, customer details, addresses, phone numbers, and regulated content; also choose output paths carefully because generated Word files may overwrite existing files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation explicitly instructs users to copy prompts derived from company Word materials into Claude, but provides no warning about confidentiality, personal data, trade secrets, or third-party data handling. Because the skill is designed for enterprise marketing content generation, the source documents are likely to contain sensitive internal business information, making inadvertent data disclosure a realistic risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The end-to-end workflow normalizes sending company document-derived content to Claude as a standard step without disclosing retention, access, or compliance risks. In the context of a business-content skill, this increases the chance that users will paste proprietary or regulated content into an external service without authorization or sanitization.

Static analysis

No suspicious patterns detected.