ClawHub
Back to skill

Security audit

questionnaire-quality-checker

Security checks for vulnerabilities and agentic risk

Overview

This skill locally checks questionnaire CSV files for data-quality issues and does not show hidden, networked, credential, or destructive behavior.

Before installing, confirm you are comfortable running a local Python script on questionnaire CSV data and review the JSON config carefully, because the checker only flags cases for human review and does not decide which responses should be deleted.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The manifest description is written entirely in Chinese and presents the skill's usage conditions only in Chinese except for a few trigger phrases, which effectively constrains use to a specific language without stating that language choice is optional. The policy for this category requires flagging language or locale constraints unless the skill offers a language choice or clearly justifies the restriction.

Static analysis

No suspicious patterns detected.