ClawHub
Back to skill

Security audit

李彦宏思维视角 v2.0

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only persona/perspective skill with no system access, commands, credentials, network use, or persistence.

Before installing, consider narrowing or explicitly invoking the skill if you do not want broad Chinese terms like “技术信仰” or “工程师文化” to trigger persona-style responses. Treat outputs as an analytical lens based on public information, and note the artifact’s proprietary license language before reuse or redistribution.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list contains broad, generic phrases such as “技术信仰”, “专注主义”, and “工程师文化” that are common discussion topics rather than narrowly scoped invocation terms. This can cause accidental activation of the skill in unrelated conversations, leading to unrequested persona steering and making prompt-routing behavior easier to manipulate or hijack.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list contains broad phrases such as “技术信仰”, “专注主义”, and “工程师文化” that can appear in ordinary business or technology discussions, causing the skill to activate outside the user’s actual intent. In an agent setting, unintended activation can steer responses into this persona unexpectedly, degrading reliability and potentially overriding more appropriate task-specific behavior.

Static analysis

No suspicious patterns detected.