ClawHub
Back to skill

Security audit

Shiyi Proactive Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed proactive assistant, but it reads shared workspace memory and recent interaction history and writes task/log files by default with broad monitoring scope.

Review before installing. Use it only in a workspace where it is acceptable for the skill to read agent memory, recent interaction history, planning files, and content metadata, and to write task/log files under memory. Do not run daemon or heartbeat integration unless you want repeated background checks. Treat trading/content suggestions as advisory only; the reviewed code did not execute trades or publish content.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/context_analyzer.py:12
Finding

Workspace Memory and Recent Interaction History Exposed Through Context Analysis

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises scripts that analyze context and auto-save proposed tasks, and the static analysis detected file read/write capabilities, but the manifest declares no explicit tool scope or permissions boundary. In an agent ecosystem, this can lead to overbroad access and unclear operator expectations, increasing the chance that the skill reads or writes local data beyond what users intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says the agent 'anticipates needs and takes initiative' and 'monitors environment' without clear activation criteria, stop conditions, or user-approval gates. In a proactive skill, ambiguous trigger language can cause an orchestrator or user to invoke it too broadly, leading to unnecessary monitoring, unsolicited actions, or action recommendations in sensitive contexts like trading.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README introduction repeats broad proactive behavior without defining operational boundaries, reinforcing the risk that the skill is treated as always-on or universally applicable. Because the skill also references monitoring, task initiation, and suggestions tied to market activity, unclear boundaries can increase the likelihood of intrusive or high-consequence behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation describes daemon/background monitoring and task auto-save behavior but does not warn about resource usage, persistence, file modification, privacy implications, or how alerts are throttled in practice. Users may enable continuous monitoring without understanding that the skill may repeatedly inspect context and write files over time, which increases operational and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language labeling in this file is entirely in Chinese, and there is no indication that language choice is configurable or based on user preference. This can violate a language or locale policy when the skill imposes a specific language without explicit user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest enables monitoring across very broad domains such as "time," "market," "content," "tasks," and "learning" without defining explicit trigger boundaries or exclusion conditions. Because the file does not specify when these domains should not activate, the proactive behavior could be invoked more broadly than intended.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The configuration authorizes autonomous execution of reminders, research, and preparation without an approval gate. In a proactive agent context, this can cause the system to take initiative based on inferred context, potentially triggering unwanted external interactions, excessive data gathering, or cascading task execution without clear user consent.

Content

Scanner excerpt · config/proactive_config.yaml (reported line 21)May include surrounding context.

yaml
- learning  # 学习优化

# 自动执行权限
auto_execute:
  - reminders  # 提醒
  - research  # 研究
  - preparation  # 准备工作

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code's user-facing natural-language description and all visible suggestions are hard-coded in Chinese, with no indication that users can select another language or opt in to this locale. The policy explicitly calls for flagging language or locale constraints when a specific language is forced without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code contains natural-language descriptions in Chinese and later presents user-facing CLI help and printed output in Chinese only. That creates a language/locale policy concern because the skill forces a specific language without user opt-in or any documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s natural-language description states the skill as a Chinese-language '主动监控器', and all user-facing CLI messages throughout the script are hardcoded in Chinese. There is no visible user opt-in, locale selection, or documentation justifying a Chinese-only interface, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file contains user-facing natural-language descriptions and CLI help text in Chinese, beginning with the module docstring and continuing throughout the script. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/task_initiator.py (reported line 49)May include surrounding context.

python
"查看小红书昨日数据",
                    "确认今日待办事项"
                ],
                "auto_execute": False
            },
            "trading": {
                "name": "交易监控",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/task_initiator.py (reported line 58)May include surrounding context.

python
"查看小红书昨日数据",
                    "确认今日待办事项"
                ],
                "auto_execute": False
            },
            "trading": {
                "name": "交易监控",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/task_initiator.py (reported line 68)May include surrounding context.

python
"查看小红书昨日数据",
                    "确认今日待办事项"
                ],
                "auto_execute": False
            },
            "trading": {
                "name": "交易监控",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/task_initiator.py (reported line 77)May include surrounding context.

python
"查看小红书昨日数据",
                    "确认今日待办事项"
                ],
                "auto_execute": False
            },
            "trading": {
                "name": "交易监控",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/task_initiator.py (reported line 85)May include surrounding context.

python
"查看小红书昨日数据",
                    "确认今日待办事项"
                ],
                "auto_execute": False
            },
            "trading": {
                "name": "交易监控",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/task_initiator.py (reported line 94)May include surrounding context.

python
"查看小红书昨日数据",
                    "确认今日待办事项"
                ],
                "auto_execute": False
            },
            "trading": {
                "name": "交易监控",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/task_initiator.py (reported line 108)May include surrounding context.

python
"查看小红书昨日数据",
                    "确认今日待办事项"
                ],
                "auto_execute": False
            },
            "trading": {
                "name": "交易监控",

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes a proactive agent that monitors context, suggests actions, and proposes tasks. This file goes beyond proposing by creating a persistent task database and mutating task status in proactive_tasks.json, which is a state-management capability not stated in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example output presents user-facing content in Chinese, but the document does not state that the skill is Chinese-only or allow the user to choose their preferred language. This can violate language/locale policy expectations when a skill implicitly forces a language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The top-level docstring says "任务发起器 - 主动提出并执行任务" (proactively propose and execute tasks), but no code in this file actually executes task steps or carries out external actions. The implementation manages task metadata and status only, creating a direct mismatch between the documented intent and the behavior.

Content

No source excerpt is available for this finding.