ClawHub
Back to skill

Security audit

Apple HigDesign Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only Apple design reference skill with minor routing and formatting rough edges, but no evidence of hidden execution or data access.

Reasonable to install if you want Apple HIG-style design help. Expect it may sometimes trigger on broad Apple platform mentions, and verify current Apple design details against official Apple documentation when accuracy matters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list contains broad terms like "Apple平台", "watchOS", and general Apple design phrases that can match ordinary conversation outside the intended Apple HIG design-assistance context. This can cause unintended activation, leading the agent to inject irrelevant guidance or override a more appropriate skill, which is a real prompt-scope and routing risk even though it is not directly code-execution related.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The skill prescribes a fixed Chinese-only response structure without offering language negotiation or respecting the user's language, which can cause the system to respond in an unintended language and reduce usability or clarity. In a multi-skill environment, this also creates instruction-precedence friction because the skill may steer output formatting and language even when the user's request is in another language.

Static analysis

No suspicious patterns detected.