ClawHub
Back to skill

Security audit

决策架构师免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Markdown decision-support guide, but it requests command execution and write access that its own documentation says it does not need.

Review before installing. The decision-analysis instructions themselves look benign, but the package should not need command execution or write permission for the behavior it documents. Prefer a version that removes exec/write or clearly explains any local writes and command use.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill explicitly claims it is pure Markdown and does not require exec capability, while the manifest grants exec. This mismatch can cause users or hosting agents to trust the skill more than they should, enabling unnecessary command execution if the skill is later modified or interpreted permissively by the platform.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The documentation says the free version does not persist decision records, but the manifest grants write access. Even if no malicious logic is shown, write permission creates the ability to store data locally, which contradicts user expectations and weakens informed consent around privacy and data handling.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The manifest advertises exec and write capabilities without a corresponding user-facing warning in the skill description. Hidden or undisclosed powerful capabilities increase the chance that users invoke the skill without understanding its access level, which is especially risky for a decision-support skill whose stated purpose does not inherently require filesystem or command execution privileges.

Static analysis

No suspicious patterns detected.