ClawHub
Back to skill

Security audit

research-methodology

Security checks for vulnerabilities and agentic risk

Overview

This skill is a low-risk research-methodology and multilingual-response guide with no executable code, credential handling, persistence, or privileged actions.

Before installing, expect this to be a lightweight methodology/provenance prompt rather than a full research automation tool. The main practical issue is broad activation wording; users who want precise routing may prefer narrower trigger terms, but no security-sensitive behavior was found.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description embeds a very broad trigger list including generic terms such as “调研”, “研究”, “查证”, and “desk research”, which are likely to match many ordinary user requests outside the intended scope. This can cause the skill to activate opportunistically, intercepting unrelated conversations and increasing the chance of inappropriate routing, unexpected behavior, or misuse of the methodology in contexts where it was not explicitly requested.

Static analysis

No suspicious patterns detected.