ClawHub
Back to skill

Security audit

618素材文本提报助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed Taobao seller automation helper, but it can automatically submit live business materials without a documented review or confirmation step.

Install only if you are comfortable with an agent filling and submitting Taobao seller-center material fields on your behalf. Prefer a version that lets you preview generated names and recommendations, run in fill-only mode, and explicitly approve before any final submit action.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README explicitly states the skill will automatically fill and submit marketplace activity materials, but it does not warn users that this modifies seller-controlled data and may trigger irreversible or unintended submissions. In the context of a logged-in Taobao seller session, automated submission can cause accidental publishing of incorrect promotional content, policy violations, or unauthorized changes if invoked without clear confirmation.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly states it will automatically submit filled content, which is a state-changing action affecting a seller account, but it does not mention any confirmation, review step, or warning to the user. In the context of a Taobao seller center workflow, silent submission can cause unintended campaign enrollment data, incorrect promotional copy, or irreversible business-side changes if the generated text is wrong or applied to the wrong items.

Static analysis

No suspicious patterns detected.