ClawHub
Back to skill

Security audit

合约Agent专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a contract-platform guide, but it asks for broad agent authority around real payments, automated dispute rulings, identity, webhooks, exports, and command execution without enough scoping or user approval requirements.

Review this carefully before installing. It is not clearly malicious, but it is designed for workflows that can affect money, contracts, identity, external systems, and persistent audit data. Use sandbox payment credentials first, require explicit human approval for live transactions and dispute outcomes, and limit which files, endpoints, credentials, and commands the agent may access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is presented as a contract/legal workflow tool, but it also advertises generic file processing, command execution, API integration, and information retrieval capabilities. That capability expansion increases the attack surface and can let the skill be invoked for actions outside the user’s expected legal-contract scope, especially since the skill declares exec/write/read tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation says the skill is not suitable for legal judgments, yet it prominently offers AI arbitrator auto-rulings for disputes. This contradiction can mislead users into relying on automated outputs for high-impact quasi-legal decisions, reducing human oversight where financial or contractual rights are affected.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger description is so broad that the skill may be selected for general AI dialogue, orchestration, or LLM use cases far beyond its intended domain. In combination with exec, write, and external integration capabilities, ambiguous triggering increases the chance of accidental high-impact actions such as payments, exports, or system interactions without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill describes real payment gateways and fund movement but does not present a prominent safety warning that actions may have real financial and external-system consequences. Users or downstream agents could mistake examples for low-risk automation and trigger real transactions, webhooks, or account-side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The AI arbitration section enables automated dispute decisions with financial consequences, but the warning about high-impact automated decision-making is not prominent at the point of use. That creates a risk that users treat the system as an authoritative adjudicator despite uncertainty, bias, or incomplete evidence.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The documentation includes webhook and API endpoints for external transmission, which confirms the skill is designed to send data outside the local environment. In this context the issue is not the mere presence of a URL, but that external transmission is coupled with payment, ERP, DID, and audit integrations without strong boundaries on what data may be sent and under what approval conditions.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
# ...
  stripe:
    secret_key: ${STRIPE_SECRET_KEY}
    webhook_url: https://api.company.com/webhook/stripe
# ...
  alipay:
    app_id: ${ALIPAY_APP_ID}

Static analysis

No suspicious patterns detected.