Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent ClawHub skill finder; its main risk is that it can steer users toward installing other skills and uses Chinese-oriented output.
Before installing, expect this skill to search ClawHub and may recommend installing other skills. Review any recommended skill before approving installation, and expect Chinese-oriented prompts/output unless you override it in your request.
The trigger phrase list is broad enough to match ordinary requests about finding tools or help, which can cause the skill to activate outside its intended scope. Overbroad activation increases the chance that this skill intercepts unrelated conversations and nudges users toward searching or installing third-party skills they did not explicitly request.
The usage examples describe common natural-language requests without strong scope constraints, so the agent may invoke this skill for generic assistance queries. In a marketplace-installation context, ambiguous activation can steer users into package discovery and installation workflows when they only asked for advice, increasing supply-chain and consent risks.
The output format requires '简短描述（中文）', which imposes a specific language on responses. This is a locale/language policy concern because the file does not indicate user opt-in or provide an alternative based on user preference.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
→ 推荐安装
安装命令: clawhub install crypto-tracker 安装后验证: ls ~/.openclaw/workspace/skills/crypto-tracker/SKILL.md
## v1.0.1 更新
The script contains user-facing natural-language strings only in Chinese, including the title comment and usage output. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
The note '中文输出优化' indicates the skill is optimized around Chinese output, but the file does not clarify that this is optional or limited to a Chinese-speaking audience. This supports the broader language-forcing pattern elsewhere in the document.
The package name and description explicitly label the skill as 'CN' / '查找器', indicating a Chinese-language or China-specific variant, but the file provides no user choice, opt-in, or justification for this locale constraint. This can violate language/locale policy guidance when a skill appears to enforce a specific locale by default.
No suspicious patterns detected.