ClawHub
Back to skill

Security audit

Industry Research Maching Engine

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese education-and-career research prompt skill with public web research instructions and no executable or hidden privileged behavior.

Installers should expect this skill to generate Chinese consulting-style reports and perform public web research. Verify admissions numbers, salary ranges, job descriptions, and school recommendations against official sources before making education or career decisions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill metadata fixes the interaction in Chinese without indicating any user choice, which can override user language preference and reduce accessibility or transparency for non-Chinese-speaking users. This is not a code-execution risk, but it is a genuine policy and usability/security issue because rigid language forcing can mislead users about available interaction modes and impede informed use.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The output-format section mandates a fixed Chinese-language style and tone with no user opt-in, which can force responses into a language and presentation style the user did not request. In context, this is less dangerous than prompt injection or data exfiltration, but it remains a true vulnerability because it constrains user autonomy and can cause exclusion, misunderstanding, or non-compliant behavior in multilingual settings.

Static analysis

No suspicious patterns detected.