ClawHub
Back to skill

Security audit

"养老机构运营合规自查助手"

Security checks for vulnerabilities and agentic risk

Overview

This skill provides a local, human-reviewed self-audit template with no evidence of hidden access, data uploads, or persistent changes.

Use this as a manually completed preparation aid. It does not implement every advertised national-standard requirement or automatically complete assessments and remediation tracking. Check official standards and current local requirements, replace the example staffing ratios, and review every conclusion before relying on a report. Protect reports containing staff names and certificate details. Regulatory accuracy was not established by this security review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code supports the declared domain, staffing calculations, certificate-expiry warnings, and human-review disclaimers. However, its central compliance-assessment functionality is a manually completed checklist scaffold rather than the declared standards-based assessment and remediation output. Priorities are assigned using mandatory-check flags and whether the basis string contains 'GB48014', not by implementing the 25 direct-determination rules. These are material capability gaps, not merely implementation details. No undeclared network access, exfiltration, or unrelated behavior is evident; file access is limited to the user-selected JSON input.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The advertised national-standard assessment is implemented as a 64-item regional checklist without explicit coverage of the promised 90 requirements and 25 direct-determination factors.

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

The manifest promises item-by-item checks against 90 GB48013 requirements and 25 GB48014 direct-determination factors. However, L419 builds the assessment exclusively from the regional CHECKLIST at L085–L226, and L468 explicitly identifies that regional list as the report's source; the code provides no complete national-standard enumeration or coverage mapping. Consequently, the generated checklist cannot substantiate the national-standard coverage advertised by the manifest, potentially leaving safety requirements unexamined.

Content

No source excerpt is available for this finding.