ClawHub
Back to skill

Security audit

volcengine-compliance

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Volcengine compliance helper that uses disclosed cloud credentials and only performs cloud-side writes after explicit confirmation.

Install only if you are comfortable letting the skill use your Volcengine CLI session or VOLCENGINE_* credentials for Config compliance checks. Start with recommend or overview, review any dry-run output carefully, and only allow --confirm when you intend to create conformance packs, enable the recorder, or register custom audit rules. Treat generated reports as potentially sensitive because they can include account IDs, resource IDs, regions, and compliance annotations.

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
"RuleTemplateId": r.get("RuleTemplateId", ""),
                "Effect": r.get("Effect", ""),
            }
    return rules


def build_category_index():
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes shell-capable tooling (`python3`, `ve`) and can perform state-changing operations (`apply`, enabling recorder, creating rules), but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens containment because an agent/runtime may permit broader shell or file-write access than the skill actually needs, increasing the blast radius if the skill is misused or if command arguments become influenced by untrusted input.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The entire markdown reference is presented exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy for this category flags forced language or locale constraints when they are not opt-in or clearly justified.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
This markdown file presents the skill guidance entirely in Chinese and does not indicate that the user may choose another language. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a natural-language policy violation.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
payload = json.dumps(body, ensure_ascii=False)
    last_err = None
    for attempt in range(RETRY + 1):
        proc = subprocess.run(
            ["ve", "config", action, "--body", payload],
            capture_output=True,
            text=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
The document title and all user-facing instructions are written in Chinese, with no indication that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Static analysis

No suspicious patterns detected.