ClawHub
Back to skill

Security audit

黄毛决胜法 Alpha Game Mastery

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese-language self-improvement/social strategy skill with no executable code, permissions, persistence, or hidden agent-control behavior.

Install only if you want Chinese-language social-confidence and relationship-strategy coaching. The skill does not appear to add technical privileges, but its advice concerns interpersonal behavior, so users should apply it ethically and avoid manipulative use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: alpha-game-mastery
description: >-
  黄毛决胜法 — 提升个人魅力、吸引力与博弈能力的终极技能。
  从姿态逆转、张力制造到筛选框架，彻底改造你的社交博弈底层逻辑。
  🌐 社区 @AntCaveClub · YouTube @0xcii · Bot @yongzhuan_bot
version: 1.0.2
emoji: 🏀
homepage: https://github.com/0xcii/alpha-game-mastery
metadata:
  openclaw:
    requires:
      bins: []
    primaryEnv: ""
    envVars: []
    always: false
---

# 🏀 黄毛决胜法 — Alpha Game Mastery

> **魅力不是天生的，是可以设计的。**
> 这不是让你去当"黄毛"，是让你学

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description forces a specific language experience and does not indicate that users can opt into another language or that the skill is intentionally region-specific. Under the language/locale policy, a fixed language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This README presents all user-facing instructions and descriptions exclusively in Chinese, including usage guidance and FAQs. Under the policy rule for language or locale constraints, this can be a violation when no user opt-in, alternate language option, or justification for the language restriction is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.