ClawHub
Back to skill

Security audit

lanhu-code-2-el-vue

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Vue conversion workflow, but it delegates to an unbundled skill and can run npm commands and modify router configuration without clear user approval.

Install only if you are comfortable with a skill that writes Custom.vue, may update router files, and may run npm commands. Treat ui-ux-max-pro as an additional required dependency that should be reviewed or pinned before use, and require explicit confirmation before package installation, npm script execution, or router changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:11
Finding

Mandatory Delegation to an Unbundled and Unaudited External Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-17
Vulnerability Type: Untrusted external instruction delegation
Risk Level: High

Relevant instruction snippet translated into English:

text
When this Skill is triggered, ui-ux-max-pro must be executed first:

1. Read and comply with the SKILL.md of ui-ux-max-pro.
2. First complete the UI/UX analysis, layout assessment, visual consistency
   inspection, and usability evaluation required by ui-ux-max-pro.
3. Use the conclusions from ui-ux-max-pro as design constraints for the
   subsequent conversion.
4. Then continue with the index.vue to Custom.vue conversion workflow.
5. If ui-ux-max-pro cannot be found, inform the user and pause.

Technical Analysis

The Skill mandates loading and obeying another Skill named ui-ux-max-pro, but that dependency is not included in the audited project. Consequently, its identity, integrity, version, and instruction contents cannot be verified as part of this audit.

This creates an instruction-trust boundary: loading the audited Skill automatically transfers part of the agent's control flow to mutable external instructions. An attacker who can create, replace, or influence the externally resolved Skill could introduce directives unrelated to UI analysis, including broader file access, command execution, disclosure of project content, or attempts to override the original task.

The requirement to “read and comply” does not constrain which external directives may be inherited and does not state that higher-priority instructions, user authorization boundaries, or security restrictions must remain authoritative.

Attack Path

  1. An attacker places or replaces a Skill named ui-ux-max-pro in a location searched by the agent.
  2. The user invokes the audited lanhu-code-2-el-vue Skill.
  3. The audited Skill requires the agent to resolve and read the external Skill's SKILL.md.
  4. The agent follow ...[truncated 895 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle the required dependency with the Skill package so both instruction sets can be reviewed together.
  2. Pin the dependency to an immutable version and verify a cryptographic digest before loading it.
  3. Replace unrestricted “read and comply” language with a narrow interface specifying exactly which UI-analysis output may be consumed.
  4. Explicitly state that delegated instructions cannot override system instructions, user authorization, security controls, or the current task scope.
  5. Reject ambiguous Skill resolution and require an exact trusted path or signed registry identity.
  6. Present the dependency and requested delegation to the user for approval before loading it.
  7. If the dependency is missing or fails integrity validation, stop without searching arbitrary project or user-controlled directories for substitutes.

T08 · Insecure Dependencies

Error
Location
data/execution-flow.md:8
Finding

Automatic Execution of Unreviewed npm Lifecycle and Project Scripts

Content
View full analysis

Vulnerability Details

File Location: data/execution-flow.md, lines 8-13
Additional Location: data/workflow-summary.md, lines 42-44
Vulnerability Type: Unsafe dependency installation and project-script execution
Risk Level: High

Relevant instruction snippet:

bash
# Check whether Element UI is installed
npm list element-ui

# Install it if it is not installed
npm i element-ui@2.15.14 -S

Additional validation instruction translated into English:

text
Stage 6: Validation testing
- Style inspection
- Functional inspection
- Code inspection
- Run tests with: npm run serve

Technical Analysis

The workflow instructs the agent to install an npm dependency and later execute npm run serve. Both operations can execute code controlled by the target project or its dependency graph.

An npm installation may invoke lifecycle hooks such as preinstall, install, and postinstall from the root project or installed packages. Running npm run serve executes the command defined by the target repository's package.json, which may be arbitrary shell code.

The Skill also restricts inspection of package.json while generating the page. If this restriction is interpreted broadly during execution, the agent may run the serve script without first reviewing what it does. Pinning element-ui to version 2.15.14 limits direct version drift but does not validate the lockfile, npm registry configuration, transitive dependency resolution, existing root lifecycle hooks, or the contents of the project-defined serve script.

Attack Path

  1. An attacker prepares a target Vue repository containing a malicious root lifecycle hook or serve script in package.json.
  2. The user asks the agent to convert a page in that repository.
  3. The agent follows the environment-preparation instruction and executes npm i element-ui@2.15.14 -S.
  4. npm invokes an attacker-controlled life ...[truncated 927 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not install dependencies or start the project automatically. Require explicit user approval for each command.
  2. Review package.json, lockfiles, workspace manifests, .npmrc, and all relevant lifecycle and project scripts before execution.
  3. Use npm ci with a reviewed, integrity-locked dependency graph instead of modifying dependency resolution through npm install.
  4. Use --ignore-scripts during dependency installation where lifecycle scripts are not required.
  5. Configure a trusted registry and reject project-controlled registry overrides unless explicitly approved.
  6. Run installation and development servers in an isolated, low-privilege container without sensitive environment variables or host credentials.
  7. Apply filesystem and network restrictions so project scripts cannot access unrelated directories or arbitrary external services.
  8. Display the resolved serve command to the user and request confirmation before running it.
  9. Separate source restrictions for UI design from security inspection: package.json may be prohibited as a visual source while still being mandatory to inspect before npm execution.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:657
Finding

Mandatory Modification of Shared Router Configuration Beyond the Primary Target File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 657-676
Vulnerability Type: Unnecessary expansion of project write scope
Risk Level: Medium

Relevant instruction snippet translated into English:

text
Route registration check required for delivery:

- A route conforming to project conventions has been added to the router file
  for src/views/${folderName}/.
- Import paths point to real files, components match variables, and there are
  no duplicate paths or names.
- Opening the new path locally does not return 404.

Step 8: Route registration and validation after Custom.vue is written

1. Read the project router entry, which is src/router/index.js in this repository.
2. Search for ${folderName} and views/${folderName}/Custom.vue; compare with
   existing views and their paired static and dynamic route convention.
3. If missing, add imports for index.vue and Custom.vue and append path, name,
   and component entries to routes.
4. Open the new path in a browser and confirm that it renders without errors.

Do not omit this step.

Technical Analysis

The principal operation described by the Skill is creation or replacement of src/views/${folderName}/Custom.vue. The delivery stage nevertheless mandates reading and modifying the shared application router.

This expands the write boundary from one view component to project-wide configuration. It also directs the agent to inspect existing views to infer route conventions, despite earlier source-boundary rules that prohibit using unrelated project files during page generation. Although the router access occurs after component generation, it still broadens the operation beyond the minimum required to produce the requested component.

The ${folderName} value is extracted from user input and used to construct paths, import targets, route names, and URLs. The reviewed instructions do not define a strict allowlist or path-validation rule f ...[truncated 1431 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make route registration optional and require separate, explicit user authorization before modifying shared configuration.
  2. Default to generating Custom.vue only, then provide a proposed router patch for review.
  3. Validate ${folderName} against a restrictive pattern such as lowercase letters and underscores, and reject path separators, traversal sequences, control characters, and unexpected punctuation.
  4. Resolve and verify the final component path remains inside the intended src/views directory.
  5. Parse router configuration structurally rather than applying fragile text insertion.
  6. Detect duplicate route paths, names, and imports before proposing a change.
  7. Preserve a backup or use a transactional patch that can be reverted if validation fails.
  8. Do not inspect unrelated views merely to infer conventions; use a documented route template or request the desired path from the user.
  9. Report route registration as a separate modification in the final change summary.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (44)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
1. 先读取并遵守 `ui-ux-max-pro` 的 `SKILL.md`。

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises a tightly scoped source boundary but then requires reading additional skill files and later route-related project files. This mismatch weakens operator trust and enables scope expansion beyond what a user would reasonably expect, increasing the chance of unintended access to unrelated repository content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill says other repository files must not be referenced, but later permits reading and modifying router files. That contradiction can be abused to justify post-task changes to unrelated application wiring, turning a page-conversion task into a broader codebase modification task.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

vue
<template>
  <div class="[folderName]_page_container">
    <!-- 改造后的动态页面内容 -->
    <!-- 1. 将重复结构改为 v-for 循环渲染 -->
    <!-- 2. 将原生的 input、button、checkbox、radio 等替换为 Element UI 组件（开关不替换，保留原生结构） -->
    <!-- 3. 保留所有样式，确保像素级一致 -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

vue
<template>
  <div class="[folderName]_page_container">
    <!-- 改造后的动态页面内容 -->
    <!-- 1. 将重复结构改为 v-for 循环渲染 -->
    <!-- 2. 将原生的 input、button、checkbox、radio 等替换为 Element UI 组件(开关不替换,保留原生结构) -->
    <!-- 3. 保留所有样式,确保像素级一致 -->

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 688)May include surrounding context.

md
| 项目配置 | `data/project-config.md` | 文件路径、技术栈、改造目标、改造前后示例 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 697)May include surrounding context.

md
| 常见问题 | `data/faq-solutions.md` | 样式、循环、图片、布局、交互等常见问题及解决方案 |

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file instructs the agent to look for and execute requirements from function.md, then repair dependencies and start the project after finishing page-style work. This expands the skill far beyond its declared purpose and creates an uncontrolled instruction pivot to another file, allowing unscoped actions and additional behavior not covered by the original constraints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says the source material is limited to index.vue, its referenced CSS, and asset paths, but this file authorizes reading and acting on function.md. That contradiction defeats the skill's scope boundary and can be used to smuggle additional instructions or requirements through an auxiliary file the agent was supposed to ignore.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document first states that only index.vue and its referenced styles/assets may be read, then later introduces other files as mandatory authority. This kind of self-contradictory guidance is dangerous because an agent may follow the broader instruction path, bypassing least-privilege constraints and reading files the user did not authorize.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill manifest restricts source material to index.vue, referenced CSS, and asset paths, but this file later instructs the agent to consult additional repository files as authoritative references. That contradiction can cause scope expansion and unauthorized reading of unrelated files, undermining user-imposed data boundaries and enabling prompt-level exfiltration of repository context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill manifest restricts analysis inputs to index.vue, its referenced CSS, and asset paths, but these instructions explicitly require consulting data/element-ui-style.md. That creates a conflicting trust boundary and can cause the agent to ingest unauthorized repository content, enabling prompt-scope expansion, contamination of outputs with unrelated files, and policy bypass through auxiliary documentation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This instruction tells the agent to use data/class-naming.md to decide class handling, even though the skill description limits source material to index.vue, referenced CSS, and assets. Such cross-file dependency undermines the declared source restrictions and can be abused to smuggle hidden instructions or unrelated repository knowledge into the transformation process.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill description and operational text are written to require Chinese-language behavior, but there is no indication that users may choose another language or that the locale restriction is required for a region-specific compliance reason. This can violate language/locale policy when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs immediate generation of Custom.vue, implying file creation or overwrite without an explicit warning or confirmation. In an automated agent setting, this can cause silent workspace modification and accidental loss of existing work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to write Custom.vue directly rather than present code first removes a natural review checkpoint. This increases the risk of unintended or unsafe code being committed to the workspace before the user can inspect scope, logic, or file targets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill allows route-file modification during delivery without prominently warning that application routing will change. Routing changes affect app behavior globally and are more sensitive than local component generation, so silent modification raises operational and security risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims the agent should only read a narrow set of files after validation, yet later instructions depend on numerous additional documents and router files. Such internal inconsistency undermines least-privilege constraints and makes it easier for an agent to justify over-reading the repository.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Mandatory route registration and browser access validation exceed the narrow purpose of converting a static page into a dynamic component. This broadens the skill's effective permissions and creates unnecessary opportunities to alter application behavior or expose new routes without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The entire skill document is written as a mandatory instruction set in Chinese and does not indicate that another language may be used or that the language requirement is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is justified as region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Directing the agent to check for missing dependencies, fix them, install packages, and start the project introduces package-management and execution capabilities unrelated to static page refactoring. These actions can modify the environment, trigger unreviewed scripts, and increase the blast radius from a simple code transformation task to arbitrary project execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file is entirely written as mandatory operating guidance in Chinese, including explicit compliance language such as '执行任务 4 时须全文遵循'. That effectively forces a specific language/locale for skill use without any opt-in, alternative language path, or stated region-specific justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill includes npm installation commands that alter dependencies and the local environment without requiring an explicit warning or confirmation. Dependency installation can change lockfiles, pull unreviewed code from registries, and affect build/runtime behavior, so silent execution is risky even if operationally motivated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

These instructions direct the agent to create or modify project files such as Custom.vue as part of the workflow, but they do not include an explicit user warning that files will be changed. In an agent setting, undisclosed file modification increases the risk of surprising or unauthorized workspace changes, especially if the user asked for analysis or planning rather than execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file presents all instructions and requirements exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.