ClawHub
Back to skill

Security audit

数据工具箱(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This data-engineering skill is mostly purpose-aligned, but it asks for broad read/write/command authority and workflow scheduling without enough scoping or user-control guardrails.

Install only if you are comfortable giving the agent command execution and filesystem mutation authority for data workflows. Use it in a limited project directory, run only trusted scripts and configurations, keep credentials in environment variables or a protected store, and review any scheduled jobs before enabling them.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill claims command execution is limited to a whitelist, but elsewhere documents execution of workflow scripts such as extract.py, clean.py, report.py, lineage.py, and workflow.py via exec/uv run. That inconsistency can mislead users and agents into trusting a supposedly constrained execution model when the skill actually enables arbitrary local code execution through script names and configuration, increasing the risk of running untrusted code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The activation wording is very broad, covering generic data analysis, reporting, statistical insight, and visualization use cases. In an agent setting, overly broad triggers increase the chance the skill activates in situations where users did not intend to grant file write or command execution capabilities, expanding exposure to risky operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation describes configuring workflows and scheduling commands that can create files, modify configuration, and execute local scripts, but it does not prominently warn users about filesystem changes, scheduled task side effects, or the trust requirements for referenced scripts. This can cause users or agents to run impactful operations without understanding persistence, overwrite, or execution risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.