ClawHub
Back to skill

Security audit

项目规划

Security checks for vulnerabilities and agentic risk

Overview

This skill is a project-planning helper with purpose-aligned guidance and no executable code, though users should be aware it may use available file, calendar, reminder, search, or other-agent tools for project management.

Install this if you want a Chinese-language project planner. Before allowing it to create files, calendar entries, reminders, web searches, or delegate to other skills, check what project details will be stored or shared and approve those actions explicitly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill metadata advertises broad trigger phrases such as common project-planning requests, which can cause unintentional invocation in loosely related conversations. This increases the chance that the agent activates and starts steering workflow or suggesting tool usage without the user explicitly intending to use this skill.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The natural-language activation section lists many broad, everyday expressions with no disambiguation rules, making accidental activation likely. In an agent environment, overbroad routing can expose user data to an unnecessary skill context and lead to unintended planning actions or downstream tool suggestions.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill encourages use of files, calendars, reminders, web search, and other agents but does not warn about privacy, persistence, or system-impact implications, nor does it require confirmation before externalizing user data. This can lead to sensitive project details being stored, searched, or scheduled without adequate user awareness or consent.

Static analysis

No suspicious patterns detected.