ClawHub
Back to skill

Security audit

Get Money Mindset

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only coaching skill for ethical earning experiments, with no executable code, persistence, credential handling, or hidden authority.

Before installing, understand that this skill provides business coaching frameworks, not guaranteed income or professional financial, tax, legal, credit, or mental-health advice. Users should verify platform rules and local requirements before acting on monetization suggestions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/foundations.md (reported line 5)May include surrounding context.

md
This skill combines three complementary ideas:

- **Behavior before spreadsheets.** Money choices are shaped by emotions, beliefs, and avoidance as well as arithmetic. Surface the pattern without judgement; this is reflection, not therapy or advice.
- **Capital allocation discipline.** An initiative earns more investment only when its expected business outcome, ownership, costs, and measurement are clear. For AI, assess both productivity and innovation rather than treating experimentation as value by default.
- **Compounding distribution.** Creator or content work becomes more valuable when it has a clear audience, an ethical offer, compliant distribution, and outcomes that can be measured over time.
- **Asset-building over isolated gigs.** Repeated work can become a template, a productized service, a niche tool, documented know-how, a trusted audience, or a partner channel. The useful test is whether the work leaves behind an asset or evidence that lowers the cost of the next sale.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The document switches into Chinese examples and provides a dedicated 'China-market channel checks' section, including untranslated phrases like 'AI赚钱方法', '降重', and '月入过万'. Because the file does not explicitly state that responses should adapt to user language preferences or that this reference is only for China-market requests, it risks imposing a locale/language context without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.