ClawHub
Back to skill

Security audit

Rag Hallucination Governor

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only RAG troubleshooting skill with no executable code, persistence, credential access, or hidden data flow.

Install if you want Chinese RAG hallucination diagnosis and tuning guidance. Avoid pasting sensitive production logs unless needed, and consider narrowing trigger terms if accidental activation would be disruptive.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad, everyday phrases such as '不准确' and '调参' that can match many unrelated conversations, causing the skill to activate when the user did not explicitly request it. Unintended invocation can override more appropriate routing, produce irrelevant domain-specific advice, and increase the chance that sensitive logs or business context are processed by the wrong skill.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
The skill metadata and instructions are written to enforce Chinese output without any indication that the user's language preference should be respected. This can cause responses in an unexpected language, leading to misinterpretation of diagnostics or configuration advice, especially in multilingual operational environments where precision matters.

Static analysis

No suspicious patterns detected.