ClawHub
Back to skill

Security audit

知识卡片

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese knowledge-card writing skill with no hidden code, network behavior, credential use, or automatic high-impact actions.

Install this if you want Chinese Obsidian-style concept cards. Be aware it may activate on ordinary requests to explain concepts, and use --file only when you actually want it to create a markdown file in the current directory.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill advertises very broad trigger phrases such as common requests to explain a word or analyze a term, plus generic concept examples. This can cause unintended invocation in normal conversation, leading the agent to switch into this skill unexpectedly and override the user’s preferred task or format.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The skill imposes a hard requirement to produce output in Chinese and treats it as non-optional style behavior, without checking the user’s language preference. This can cause policy and usability issues by overriding the user’s requested language, reducing transparency, and increasing the chance of incorrect or inaccessible output in multilingual contexts.

Static analysis

No suspicious patterns detected.