ClawHub
Back to skill

Security audit

Yq Knowledge Digest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed study-material generator that creates learning files and shows no hidden installation, credential access, persistence, or destructive behavior.

Install this if you want an agent to generate study materials from documents or an explicitly approved search. Before running it, confirm the requested output formats, language, file location, and whether web sources should be used; review generated educational content for accuracy.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list includes broad everyday phrases such as learning materials, notes generation, quizzes, slides, and courseware conversion, which can cause the skill to activate in contexts where the user did not clearly intend to invoke it. Over-broad invocation increases the chance of accidental execution on unrelated user content, leading to unexpected file processing, tool use, or generation behavior.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The skill metadata and behavior are defined primarily in Chinese without an explicit user language-selection or consent step, creating a risk that outputs are generated in a language the user did not request. In a content-generation workflow, this can degrade usability, cause misunderstanding, and violate product expectations around honoring the user's language context.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The quiz HTML template hardcodes the document language as Chinese (lang="zh") and uses fixed Chinese UI text, which can force a language choice the user did not make. In a generated HTML asset, this can mislead users, impair accessibility tooling, and produce non-compliant outputs when the requested or detected language is different.

Static analysis

No suspicious patterns detected.