ClawHub
Back to skill

Security audit

网络连通性诊断工具(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward network diagnostics skill that discloses its shell-based ping, DNS, traceroute, and port-check behavior, with no hidden persistence or data exfiltration found.

Install only if you want an agent to run local network diagnostic commands. Use port scanning only against hosts and services you own or are authorized to test, and be aware that corporate networks or security tools may log or block these probes.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger condition is broad enough to match many ordinary networking prompts, which increases the chance the agent invokes local shell-based diagnostic or scanning commands unexpectedly. In a skill with exec capability and port-scanning examples, loose invocation boundaries can lead to unintended network probing against user-supplied hosts, creating policy, compliance, or SSRF-like operational risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill advertises port scanning and local command execution without warning users that these actions may violate corporate policy, trigger IDS/IPS systems, or probe sensitive internal resources. In the context of an MD+EXEC skill, lack of explicit safety boundaries makes accidental misuse more likely, especially if users provide untrusted hosts or broad target ranges.

Static analysis

No suspicious patterns detected.