ClawHub
Back to skill

Security audit

CCPA Guardrail

Security checks for vulnerabilities and agentic risk

Overview

This is a local CCPA privacy guard that scans text for personal information and masks or blocks it, with minor documentation and language-scope issues but no hidden network, persistence, or destructive behavior found.

Install only if you are comfortable with a Chinese-language CLI/documentation set and a PRC-governed disclaimer. Treat it as a local masking aid, not legal advice or proof of compliance, and invoke it deliberately on text you want checked before sending that text to an AI model or logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description says this skill is a CCPA/CPRA runtime privacy guard for California personal information. However, the actual code chunk only contains a docstring stating it is a 'PIPL guard rules library' and describes a generic rules-profile structure. Even though this is only a small snippet and not enough to assess full functionality, the visible primary purpose indicated by the code is for PIPL, not CCPA/CPRA. That is a material description-to-code mismatch in regulatory scope. No undeclared resource access is visible, and the snippet does align with the claim of explicit, non-dynamic loading, but the jurisdiction and evidenced functionality do not match the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown explicitly lists activation keywords such as “个人信息检测”, “数据合规护栏”, and “US privacy”, which are broad enough to overlap with general discussion rather than a specific request to invoke this skill. The description does not provide negative examples or clear boundaries for when these phrases should not trigger the skill, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code file contains user-facing natural language in the module docstring and command-line help text entirely in Chinese. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file-level docstring states this is a "PIPL 护栏规则库" (PIPL guardrail rule library), while the skill manifest describes the skill as a CCPA/CPRA-focused guardrail for California privacy contexts. This is an active contradiction in the documented intent of the rules package, not merely missing detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documentation is entirely in Chinese, including the title, usage descriptions, and warnings, with no indication that users may choose another language or that the locale is intentionally limited. This can violate the language/locale policy criterion because it implicitly forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The natural-language policy section states that the declaration is governed by the laws of the People's Republic of China and disputes must be resolved in the developer's local court. For a CCPA/CPRA-focused skill aimed at California privacy use cases, this introduces a locale-specific policy constraint without presenting it as optional or clearly justifying it as a region-scoped tool behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The only natural-language content in this file is written in Chinese and does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and there is no indication here that the locale is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring and profile metadata present the skill in Chinese only, including the title and legal-basis description. Under the policy rule for natural-language constraints, this is a locale/language preference embedded in the skill without any visible opt-in, alternative language option, or justification that the skill is intended only for a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.