ClawHub
Back to skill

Security audit

决策架构师

Security checks for vulnerabilities and agentic risk

Overview

The skill is a decision-support helper, but its declared command and file permissions are broader than its own documentation says it needs.

Install only if you are comfortable giving this skill persistent local decision-memory access and broad agent tools, including command execution. Prefer a version that removes exec, scopes file access to its decision-architect directory, and cleans up the conflicting API/network documentation.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The skill makes contradictory trust and capability claims: one section says it is pure Markdown, needs no API keys, and makes no network requests, while other sections define a callback URL, API-key setup, TLS communication, and network/API failure handling. This misleads operators about the true attack surface and may cause them to enable the skill in environments with weaker scrutiny or over-broad permissions.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The file claims the skill is 'MD-only' and does not require exec capability, yet the manifest grants exec and later sections discuss command execution and related failures. This discrepancy can normalize unnecessary command-execution privileges, increasing the risk of arbitrary local command use if the host agent follows the manifest rather than the prose.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The manifest grants read, write, glob, grep, and exec to a decision-support skill whose stated purpose is mainly analytical and conversational. Broad filesystem and command privileges are unnecessary for the described function and materially expand the blast radius for prompt-injection, unsafe file access, persistence in local memory files, or shell abuse.

Static analysis

No suspicious patterns detected.