ClawHub
Back to skill

Security audit

Rd Cost

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese R&D cost-estimation skill with no executable code, install behavior, persistence, or data-access capability.

Install only if you want Chinese-language R&D budgeting assistance, especially for China-context high-tech enterprise and R&D super-deduction workflows. Users should confirm jurisdiction and treat compliance output as a planning aid, not legal or tax advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is framed around Chinese-language output and China-specific compliance regimes such as high-tech enterprise recognition and R&D super-deduction requirements, but it does not clearly limit itself to China-context requests or offer alternative regional handling. If invoked for other jurisdictions or users preferring another language, it may present jurisdiction-specific compliance guidance as generally applicable, creating regulatory, financial, and decision-making risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill text says users who need R&D expense evaluation, budgeting, cost estimation, ROI analysis, or feasibility analysis must use this skill, which creates an overly broad and effectively mandatory trigger. This can cause the agent to route many general finance or planning requests into a narrow template with fixed assumptions, increasing the chance of inappropriate activation, misleading outputs, and reduced user control.

Content

No source excerpt is available for this finding.