ClawHub
Back to skill

Security audit

电商滋补品详情页设计助手

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a coherent ecommerce page-design workflow, but it normalizes watermark removal for product images without requiring proof of rights or user authorization.

Review this skill carefully before installing. It can be useful for creating compliant supplement ecommerce pages, but only use watermark or image-repair steps on assets you own or are licensed to modify, and confirm the task is actually for TCM/supplement product pages when the trigger is ambiguous.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger description is broad enough to match generic ecommerce and design requests such as '做详情页' or '产品详情页', which can cause the skill to activate outside its intended niche. Over-broad activation increases the chance that users are funneled into this workflow unexpectedly, including its embedded image-manipulation and compliance-bypassing patterns, creating unsafe or inappropriate assistance.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The '何时使用' section lists ambiguous activation cues without boundaries or disambiguation rules, so common requests about product pages, exports, or marketplace images may invoke the skill unintentionally. In this skill, accidental activation is more concerning because the workflow includes sensitive operations like watermark removal and persuasive health-product marketing guidance.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill presents watermark removal as a normal image-processing step but does not warn that removing ownership marks may violate intellectual-property, contractual, or platform rules. Because it is framed as part of the standard workflow, it lowers friction for unauthorized alteration of third-party images and can facilitate misuse at scale.

Ssd 4

Medium
Confidence
96% confidence
Finding
The detailed OpenCV inpainting instructions operationalize watermark removal and normalize it as acceptable routine editing. This materially increases risk because it gives users actionable steps to conceal provenance or ownership indicators on images, which is especially problematic in an ecommerce production workflow where reused supplier or competitor imagery is common.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.