ClawHub
Back to skill

Security audit

PCB设计助手(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This PCB assistant needs review because its procurement examples lack clear approval controls and multiply requested component quantities by 1,000.

Use design and export functions with limited credentials until purchasing controls are added. Require approval of destination, shared files, quantities, and total cost before uploads, ERP requests, or orders. Replace the fixed 1,000 multiplier with an explicitly chosen batch size. Obtain the missing reference documentation before relying on integrations. The static scan reported no findings, but that does not resolve these workflow concerns.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

ERP integration is openly documented and is not inherently a suspicious scope mismatch, but its example unconditionally multiplies every BOM quantity by 1,000 before creating procurement requests. If an agent adopts this example for a real ERP workflow, it could create materially excessive requests without a user-approved production quantity; these are procurement requests, not necessarily completed purchases.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

BOM generation is declared, but uploading BOM data to a separate product lifecycle management system is not. This is a distinct external integration and write capability, rather than merely an implementation detail of generating a BOM or placing an LCSC order. The snippet defines this behavior but does not itself invoke the function.

Content

No source excerpt is available for this finding.

The workflow submits BOM and PCB orders without warning about external design-data disclosure or purchasing consequences.

High
Category
Output Handling
Confidence
96% confidence
Finding

The scenario includes synchronized BOM and PCB ordering as agent behavior without an explicit approval boundary between preparing manufacturing files and submitting an order. Although ordering is a declared feature and no submission implementation is shown, following this workflow with connected credentials could disclose proprietary design files or create financial commitments before the user approves the destination, contents, quantities, and price.

Content

No source excerpt is available for this finding.

The activation keyword list includes generic and unrelated terms such as “Use,” “when,” and branding-related language.

Medium
Category
Trigger Abuse
Confidence
96% confidence
Finding

The skill explicitly presents these terms as supported usage-scenario keywords, although they do not identify PCB-design requests. Treating everyday words and unrelated design activities as activation signals can cause unintended invocations; the isolated exclusion-related words do not establish a usable exclusion condition.

Content

No source excerpt is available for this finding.

The skill specifies Chinese-only interaction and output without offering a language choice.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The stated customization makes interaction and output entirely Chinese without an opt-in or an instruction to respect the user's preferred language. Adapting to domestic developers' habits does not establish a language-dependent requirement for PCB design.

Content

No source excerpt is available for this finding.