ClawHub
Back to skill

Security audit

财报可视化分析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a financial report visualization assistant whose file generation, API-key use, and command capability are broadly aligned with its stated purpose, though users should control where outputs and credentials are handled.

Before installing, treat it as a helper for financial report analysis and chart/report generation. Provide only the financial files and API credentials needed for the task, and ask the agent to write outputs to a specific workspace path so generated SVG, PDF, Word, or image files do not overwrite or expose sensitive material.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill repeatedly describes generating SVG, PDF, Word, and other output files, but does not warn users that files may be written to disk or where they will be stored. In an agent environment with read/exec capabilities, silent file creation can overwrite existing files, leak sensitive report contents into shared workspaces, or create unsafe artifacts without explicit user consent.

Static analysis

No suspicious patterns detected.