ClawHub
Back to skill

Security audit

代运营监理与验收顾问

Security checks for vulnerabilities and agentic risk

Overview

This skill provides contract-review and agency-handover checklists, with a privacy caution about sharing original business documents.

Share only relevant clauses and records, redact personal identifiers, signatures, payment details, and unrelated confidential information, and use an approved processing environment. Keep passwords out of the conversation. Treat account handover steps as recommendations requiring your control, and have a qualified lawyer review contractual conclusions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

The intake instructions request complete original contracts and supporting documents without a confidentiality or redaction warning.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The intake guidance asks users to provide complete factual materials, including original contracts and supporting records, without limiting disclosure to relevant excerpts or advising redaction. These documents can contain confidential commercial terms, personal information, signatures, and payment details that may unnecessarily enter the assistant's processing or conversation history. Contract review legitimately requires documentary evidence, which makes the request understandable, but the absence of data-minimization guidance creates a privacy risk; no deliberate exfiltration is evident.

Content

No source excerpt is available for this finding.