ClawHub
Back to skill

Security audit

impulse-purchase-brake

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed shopping-decision aid that asks for limited budget context to help users resist impulse purchases.

Install only if you want a direct, persuasion-oriented shopping brake. Avoid sharing more personal budget detail than needed; an approximate remaining spending amount is enough for the intended analysis.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger examples are broad enough to match ordinary shopping advice requests, so the skill may activate when the user is not actually asking for impulse-control help. That can cause misrouting, inject unnecessarily persuasive framing into neutral commerce conversations, and collect extra personal budgeting data that was not needed for the original request.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation section mixes specific promotional scenarios with very general cues like sharing a cart screenshot or saying '超市看到这个想买', making the routing boundary ambiguous. In practice this can over-trigger the skill in common shopping conversations, leading to unsolicited behavioral nudging and unnecessary collection of monthly remaining living-expense information.

Static analysis

No suspicious patterns detected.