ClawHub
Back to skill

Security audit

volcengine-sale

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Volcengine purchasing helper that requires user confirmation before paid CLI actions and does not show hidden data collection or destructive behavior.

Before installing, understand that this skill can help place real Volcengine orders through the ve CLI. Review the displayed command before confirming any purchase, and only approve dependency installation from sources you trust.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The file mandates specific Chinese output such as prompting the user with '开通成功', directing them to the console, and asking whether to retry. This is a natural-language locale constraint presented as required behavior, but the document does not offer the user any language or locale choice or justify a Chinese-only policy.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The document is entirely written as a Chinese-only routing rule and includes prescriptive user-facing wording such as ‘明确告知用户’ without indicating that responses should adapt to the user's preferred language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Static analysis

No suspicious patterns detected.