ClawHub
Back to skill

Security audit

老房改造不踩雷

Security checks for vulnerabilities and agentic risk

Overview

This is a renovation advice knowledge skill with no code execution or data access, though users should treat demolition and structural guidance as informational only.

Installers should understand this skill is advice-only. Do not rely on it as approval to remove walls, balcony elements, waterproofing, exterior components, utilities, or fire/HVAC systems; confirm structural drawings, property rules, local code, and licensed professional review first.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list contains many broad, everyday renovation phrases such as '承重墙', '老房装修', and '拆除费用', which can cause the skill to activate in conversations where the user did not clearly request this specific skill. Over-broad activation can lead to unintended context injection and responses shaped by this skill's rigid instructions rather than the user's actual intent.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
These sections recommend destructive renovation actions such as removing push-pull doors, insulation walls, and 'smashing' parts of the balcony space without pairing them with explicit warnings about structural limits, waterproofing, fire code, façade restrictions, or the need for licensed professional review. In a consumer-facing home renovation skill, readers may interpret the steps as safe DIY or generally acceptable guidance, which could lead to property damage, safety hazards, or illegal alterations.

Static analysis

No suspicious patterns detected.