ClawHub
Back to skill

Security audit

Prd Reviewer

Security checks for vulnerabilities and agentic risk

Overview

This is a document-review skill for Chinese PRD quality checks, with no executable code and only disclosed, user-confirmed document patching behavior.

Install this if you want a Chinese-language PRD reviewer for restaurant SaaS requirements. Before use, be mindful that broad review requests may route to this skill, and only approve its optional patching step when you are comfortable with it editing the PRD document and updating version or changelog text.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list includes broad terms like '需求评审', '产品评审', and '文档评审', which are common phrases that may appear in ordinary conversations. This can cause unintended invocation of the skill in contexts where the user did not explicitly request this specialized reviewer, leading to inappropriate routing, irrelevant outputs, or accidental processing of sensitive document content.

Natural-Language Policy Violations

Medium
Confidence
85% confidence
Finding
The skill is defined entirely in Chinese and presents Chinese-only behavior without indicating a supported language policy or fallback path. In multilingual environments, this can cause user confusion, misinterpretation of requirements, or incorrect review results if invoked by non-Chinese users or on documents written in other languages.

Static analysis

No suspicious patterns detected.