ClawHub
Back to skill

Security audit

Enterprise AI Governance Playbook（企业AI治理实操手册）

Security checks for vulnerabilities and agentic risk

Overview

This skill provides proportionate offline AI-governance tools, with packaging and self-check limitations but no evidence of malicious behavior.

Suitable for local drafting and preliminary assessment. Limit activation to AI-related requests and have legal or compliance staff verify regulations and final policies. Prefer corrected metadata and refreshed checksums; the bundled clean score excludes verification files and should not be treated as comprehensive assurance.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/ai_governance_quality_test.py (reported line 86)May include surrounding context.

python
items = []
    try:
        # policy 输出检查
        r = subprocess.run([PYTHON, TOOL, "policy", "--company", "测试公司", "--sector", "金融"],
                           capture_output=True, text=True, timeout=60)
        out = r.stdout or ""
        items.append({"name": "policy 命令执行成功", "pass": r.returncode == 0})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/ai_governance_quality_test.py (reported line 93)May include surrounding context.

python
for kw in ["数据分级", "禁止行为", "内容标识", "登记", "生效与修订", "人工复核"]:
            items.append({"name": f"政策草案含「{kw}」", "pass": kw in out})
        # registry 输出检查
        r2 = subprocess.run([PYTHON, TOOL, "registry", "--company", "测试公司"],
                            capture_output=True, text=True, timeout=60)
        out2 = r2.stdout or ""
        items.append({"name": "registry 命令执行成功", "pass": r2.returncode == 0})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/ai_governance_quality_test.py (reported line 100)May include surrounding context.

python
for kw in ["风险等级", "涉及数据级别", "供应商", "审批状态"]:
            items.append({"name": f"登记表含「{kw}」", "pass": kw in out2})
        # checklist apac 输出检查
        r3 = subprocess.run([PYTHON, TOOL, "checklist", "--region", "apac"],
                            capture_output=True, text=True, timeout=60)
        out3 = r3.stdout or ""
        items.append({"name": "checklist apac 命令执行成功", "pass": r3.returncode == 0})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/ai_governance_quality_test.py (reported line 126)May include surrounding context.

python
items = []
    for scenario, expected in cases:
        try:
            r = subprocess.run([PYTHON, TOOL, "classify", "--scenario", scenario],
                               capture_output=True, text=True, timeout=60)
            ok = (r.returncode == 0 and expected in (r.stdout or ""))
            items.append({"name": f"「{scenario[:12]}…」判定={expected}", "pass": ok})

The documented whole-package sensitive-data scan excludes the entire verify directory but still reports whole-package cleanliness.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The scanner prunes every directory named verify while reporting whole-package sensitive-data cleanliness. Secrets placed in those excluded directories would not affect the passing result, creating a security-validation blind spot and potentially misleading release decisions; no actual secret exposure is demonstrated here.

Content

No source excerpt is available for this finding.

Several Chinese trigger phrases lack AI-specific scope but mandate activation on any match.

Low
Category
Trigger Abuse
Confidence
97% confidence
Finding

Several Chinese triggers refer generically to governance, employee policies, or approval workflows, yet the skill mandates activation on any match. This can redirect unrelated requests into AI-governance guidance without confirming the user's intended scope; the demonstrated impact is inappropriate routing rather than data exposure or code execution.

Content

No source excerpt is available for this finding.