ClawHub
Back to skill

Security audit

查询公司|供应商|POP商家|对接商毛利及经营排名

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed, non-executable SOP for querying sensitive business and financial tables, so it should only be used by users already authorized for that data.

Install only in environments where users already have approved access to the referenced corporate and financial datasets. Treat query results as confidential business information and rely on existing database permissions, audit logging, and data-handling rules before using or sharing outputs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly enables querying highly sensitive corporate and financial data, including executives/directors, order volume, revenue, cost, gross profit, rebates, net profit, losses, and rankings, but provides no access-control guidance, purpose limitation, masking, audit notice, or user warning. In an agent setting, this creates a material risk of unauthorized disclosure, insider misuse, and overbroad retrieval of confidential business intelligence.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.