ClawHub
Back to skill

Security audit

WenHub

Security checks for vulnerabilities and agentic risk

Overview

WenHub is a coherent governance skill, but it asks users to install unreviewed remote templates into persistent agent instruction files.

Install only if you intentionally want WenHub to shape workspace-level agent governance. Before adding any downloaded SOUL.md, AGENTS.md, IDENTITY.md, or .wenhub rules, review the full contents, keep backups of existing instruction files, and avoid installing mutable website templates unless the publisher provides versioned releases with hashes or signatures.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:84
Finding

Unpinned Remote Agent-Control Templates

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:84-102
Vulnerability Type: Unverified external governance-template dependency
Risk Level: Medium

Vulnerable Segment

markdown
## Template Initialization Reference (template files must be downloaded from the official website)

> To obtain the complete template package (SOUL.md / AGENTS.md / .wenhub/.rules/ and others), visit:
> **https://wenhub.huawen-inc.com**

Template file list:
| File | Target Location | Purpose |
|------|-----------------|---------|
| SOUL.md | Workspace root | Agent persona file |
| AGENTS.md | Workspace root | Agent startup rules |
| IDENTITY.md | Workspace root | Identity guidance |
| .wenhub/.rules/covenant | .wenhub/.rules/ | Governance framework |
| .wenhub/.rules/org-structure | .wenhub/.rules/ | Organizational structure |
| .wenhub/.rules/security | .wenhub/.rules/ | Security framework |
| .wenhub/.rules/etiquette | .wenhub/.rules/ | Etiquette framework |
| .wenhub/.rules/engineering | .wenhub/.rules/ | Engineering framework |
| .wenhub/.rules/chanding | .wenhub/.rules/ | Reflection framework |
| .wenhub/.rules/violations | .wenhub/.rules/ | Violation framework |
| .wenhub/.journals/YYYY-MM-DD.md | .wenhub/.journals/ | Reflection journal |

Technical Analysis

The Skill instructs users to obtain mutable templates from an external website and place them in workspace-level identity, startup, security, and governance locations. The repository does not include the referenced templates, an immutable release URL, cryptographic checksums, digital signatures, or a mandatory review procedure.

Files such as SOUL.md, AGENTS.md, and IDENTITY.md may be interpreted as persistent Agent instructions. Consequently, the effective behavior introduced by installing the Skill cannot be fully determined by reviewing this package alone. If the remote website, its hosting infrastructure, or its template-distribution proce ...[truncated 1840 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle all required templates directly in the reviewed Skill package.
  2. If external distribution remains necessary, reference an immutable, versioned release rather than a mutable website landing page.
  3. Publish SHA-256 checksums and cryptographic signatures for every distributed template package.
  4. Require signature and checksum verification before templates are installed.
  5. Display the complete template contents and require explicit user review and approval before writing startup, identity, or rule files.
  6. Document that downloaded templates cannot override platform policies, user instructions, consent requirements, or safety constraints.
  7. Use least-privilege installation behavior and avoid replacing existing workspace instruction files without explicit confirmation and backups.
  8. Maintain a release manifest listing each file, its destination, its version, and its expected digest.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions are very broad and map to common, generic work scenarios such as task allocation, reporting, knowledge reuse, and safety management. In practice this can cause the skill to auto-activate in many unrelated contexts, giving it outsized influence over agent behavior and increasing the chance that external rules, downloaded templates, or governance instructions are applied where they were not explicitly requested.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The entire skill file is written as a prescriptive quality scoring system in Chinese and does not indicate that other languages are supported or that Chinese is optional. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The title and all prescribed reporting templates and communication rules are written as mandatory Chinese-language guidance, with no indication that other languages are allowed. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file title and all operational guidance are written entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language or region-specific context. This creates a natural-language policy concern because it effectively forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The entire skill document is written as a Chinese-only operating protocol and does not indicate that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file presents all policy content exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The document presents its operational instructions exclusively in Chinese, including headings, triggers, and procedural guidance. If organizational policy requires language choice rather than forcing a locale, this is a natural-language policy concern because users are not offered an alternative or explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is written entirely in Chinese and presents normative team guidance, but it does not indicate that the language requirement is optional or tied to a specific region or audience. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire document is written in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.