ClawHub
Back to skill

Security audit

财务分析专业套件

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent finance-analysis assistant, but it asks for broad read/execute/write authority while giving overly broad activation guidance and inconsistent disclosure about execution and credential/network behavior.

Review before installing. Use this only for finance-analysis workflows, and confirm before allowing Python execution, batch processing, external data-provider calls, or report generation. Store API keys with least privilege, avoid placing secrets in shared config files, and check generated reports/caches for sensitive financial data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill claims to be pure Markdown/natural-language driven, yet elsewhere it declares tools such as exec/write and includes executable Python workflows. This inconsistency can mislead users and host agents about the skill's execution model, reducing appropriate scrutiny and increasing the chance of unintended code execution or unsafe automation.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The documentation reassures users that API keys are stored locally and not uploaded, while also describing integration with external financial data providers and network-request behavior. This can create a false sense of safety because use of those APIs necessarily transmits credentials and request metadata to third-party services, which may expose sensitive usage patterns or data.

Vague Triggers

High
Confidence
90% confidence
Finding
The invocation guidance is overly broad, describing use whenever efficiency, automation, batch processing, or workflow optimization is needed. Such generic triggering language can cause the skill to be auto-selected for many unrelated tasks, expanding access to read/exec/write capabilities and increasing the risk of unnecessary file, system, or data-impacting operations.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents batch analysis, report export, external data access, and command/script execution, but does not pair these capabilities with clear user-facing warnings about filesystem changes, network activity, concurrency, or resource usage. In an agent environment, that omission can lead to silent report generation, external calls, or execution of local scripts without informed consent.

Static analysis

No suspicious patterns detected.