ClawHub
Back to skill

Security audit

横纵分析法

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only research prompt framework, with no code execution, credential access, persistence, or hidden data handling.

Install this if you want a reusable framework for deep or quick research reports. Be aware it may activate on broad research prompts, and avoid putting confidential material into the research target if the workflow sends the filled prompt to an external AI service.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description includes broad trigger phrases such as 'research framework', 'deep analysis report', and '快速了解某个领域', which are generic enough to match many unrelated user requests. This can cause the agent to invoke the skill in contexts where it is not the best fit, leading to prompt hijacking of workflow selection, irrelevant behavior, or reduced reliability of downstream analysis.

Static analysis

No suspicious patterns detected.