japanese-n1-sprint-coach

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

The skill is a mostly ordinary JLPT N1 study coach, but its broad triggers and unconditional response rules can take over unrelated translation or Japanese-language requests.

Install only if you want a strict Chinese-language JLPT N1 coaching style. Be aware it may resist full translations and may activate for broad Japanese or language-learning prompts unless the platform lets you control when the skill is used.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:29

Finding

Unconditional Skill Instructions Override User Intent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-32 and 245-251
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable code:

markdown

## Iron Law

1. **每次回复必须包含 N1 考点标注**——不管用户问什么，至少指出一处与 N1 相关的考点、易错点或近年真题考查频率。
2. **拒绝全文翻译**——不给出整段中文翻译，只做关键词/语法点的精准解释。
3. **所有建议必须量化**——如果提出学习计划，必须给出具体的时间、题目数量、正确率目标。
4. **易混淆对比优先**——用户提问的语法/词汇如果有常见易混点，必须用表格对比。

markdown

## 自检清单

每次回复后确认：
- [ ] 至少标注了一个 N1 考点
- [ ] 输出结构与对应模板一致
- [ ] 没有给出全文翻译
- [ ] 如果有学习建议，已量化（时间/题数/正确率）
- [ ] 易混淆对比使用了表格形式

没有选中所有项？重新生成回复。

Technical Analysis

The Skill imposes mandatory behavior on every response, explicitly applying its N1-related rules regardless of what the user asks. It also directs the agent to regenerate responses until every injected constraint is satisfied.

These instructions are not scoped to explicit N1 coaching requests. When the Skill is active, they can supersede the user's current objective by forcing unrelated N1 content, refusing otherwise legitimate full-translation requests, and changing the required response format. Broad triggers such as translation further increase the likelihood that these instructions affect requests outside the Skill's intended coaching context.

This is a current-session instruction-hijacking issue. The reviewed text does not write rules into persistent memory, execute code, access tools, or modify system-level safety controls.

Attack Path

1. The Skill is installed or loaded into an agent session.
2. A request activates the Skill through a broad trigger such as translation or Japanese-language content.
3. The unconditional “Iron Law” requires the response to contain an N1 examination point regardless of the actual request.
4. The Skill refuses a full translation even if that is the user's explicit objective.
5. The self-check directs the agent to regenerate its answer until all Skill-imposed constraints are present ...[truncated 541 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unconditional wording such as “regardless of what the user asks” with rules scoped to explicit N1 coaching requests.
2. Require confirmation that the request falls within the Skill's declared purpose before applying specialized response templates.
3. Permit full translation when explicitly requested, or ask whether the user prefers a translation or N1-focused analysis.
4. Change the self-check from a mandatory regeneration loop to a non-binding quality checklist.
5. State that user intent and higher-priority platform or safety instructions take precedence over Skill-specific formatting preferences.
6. Narrow broad triggers such as “translation” so that unrelated translation requests do not activate the Skill.
7. Add an out-of-scope behavior that answers normally or declines to apply the Skill when the request is unrelated to JLPT N1 preparation.

T08 · Insecure Dependencies

Error

• Location: .github/workflows/clawhub-publish.yml:17

Finding

Mutable ClawHub CLI Dependency Executes in a Secret-Bearing Publishing Job

Content

View full analysis

Vulnerability Details

File Location: .github/workflows/clawhub-publish.yml, line 17
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable code:

yaml

    - name: Install ClawHub CLI
      run: npm install -g clawhub@latest

    - name: Publish to ClawHub
      env:
        CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
      run: |
        mkdir -p "$HOME/.config/clawhub"
        echo "{\"registry\":\"https://clawhub.ai\",\"token\":\"$CLAWHUB_TOKEN\"}" > "$HOME/.config/clawhub/config.json"
        clawhub skill publish . --owner 987618350-cmd

Technical Analysis

The workflow installs clawhub@latest, which is a mutable dependency reference. The code executed by the job can therefore change without any modification to or review of this repository. Global npm installation may also execute package lifecycle scripts.

Although the installation step does not directly receive CLAWHUB_TOKEN, the installed clawhub executable is invoked in the following step with that secret in its environment. The token is also written to $HOME/.config/clawhub/config.json before the unpinned executable is run. If a malicious or compromised release becomes the package version selected by latest, that executable can read the environment variable or configuration file, exfiltrate the token, alter the package being published, or publish unauthorized content.

The workflow runs automatically on pushes to main, making a compromised mutable release reachable without a deliberate dependency update in the repository.

Attack Path

1. An attacker compromises the upstream clawhub npm package, its maintainer account, or the release process.
2. The attacker publishes a malicious version and causes the latest tag to resolve to that version.
3. A push to main or a manual workflow dispatch starts the publishing job.
4. The workflow installs the attacker-controlled package through `n ...[truncated 1170 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the ClawHub CLI to a reviewed exact version rather than using @latest.
2. Record and verify package integrity using a committed lockfile or an equivalent cryptographic integrity mechanism.
3. Establish a controlled dependency-update process in which version changes are reviewed and tested before publication.
4. Disable npm lifecycle scripts during installation where compatible with the CLI, for example by using --ignore-scripts.
5. Separate dependency acquisition from the secret-bearing publication step. Use a reviewed artifact or isolated job and pass only the minimum required output into the publishing environment.
6. Grant CLAWHUB_TOKEN only the minimum publication permissions and rotate it immediately if upstream package compromise is suspected.
7. Avoid storing the token in a persistent plaintext configuration file when the CLI supports direct environment-based authentication. If a file is required, set restrictive permissions and remove it in an always() cleanup step.
8. Pin GitHub Actions to immutable commit SHAs to reduce the remaining workflow supply-chain exposure.
9. Add monitoring and registry-side controls for unexpected publications, owner changes, or releases outside the approved CI process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is broad and includes generic terms such as '翻译', '语法', and '阅读', which can cause the skill to activate in conversations that are not specifically asking for this coach. Unintended invocation can confuse users, override a more appropriate skill, and increase the chance that unrelated user content is routed into this skill without clear intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains many short, everyday education terms such as '语法', '阅读', '翻译', and 'N1', which can match routine conversations unrelated to this skill’s intended scope. This can cause unintended activation and prompt hijacking of normal user interactions, reducing reliability and potentially overriding user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill mandates refusal of full translation and forces a specific response style regardless of what the user requests. This is dangerous because it can override user intent and create unsafe or misleading behavior at the orchestration layer, especially when the user explicitly needs translation rather than exam coaching.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation logic relies on broad keyword/category matching like 'contains Japanese characters' or generic study-related terms, without clear boundaries or disambiguation. In practice, this means many unrelated inputs could enter the skill’s control flow, causing unintended behavior and policy conflicts with what the user actually asked for.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The title is in English while the main description is in Chinese, and the document does not state whether the skill responds in Chinese, Japanese, or another user-selected language. This can amount to an implicit language choice without opt-in, which may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The trigger 'N1' is extremely short and ambiguous, so it may match incidental text that is not a request for this skill. While not directly exploitable as code execution, it increases accidental activation and can divert conversations into an unintended mode.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 89% confidence

Finding

The trigger '语法' is a common generic term that appears in many unrelated educational contexts. Its breadth makes accidental activation likely and undermines precise routing to the intended skill.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 89% confidence

Finding

The trigger '词汇' is too general and can appear in broad language-learning or writing-assistance conversations unrelated to JLPT N1. This expands the activation surface and can misroute benign user requests.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 89% confidence

Finding

The trigger '阅读' is a common everyday term that can refer to many non-Japanese or non-exam tasks. This creates a low-severity but real risk of unintended activation and response-style takeover.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 89% confidence

Finding

The trigger '听力' is broad and may occur in many educational or accessibility contexts not related to JLPT preparation. Its ambiguity can cause accidental invocation of the skill’s rigid templates.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger '备考' is generic across many exams and certifications, so it does not uniquely identify this skill. This broadness increases the chance that unrelated study-planning requests get captured.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger '日文' is a broad term that may match general Japanese-language requests, including translation or casual language help outside N1 coaching. This can activate the skill in contexts where its constraints are a poor fit.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The trigger '翻译' is especially broad and likely to appear in many ordinary assistant tasks. In this skill, that is more dangerous because the skill also refuses full translation, meaning accidental activation could directly conflict with the user’s actual request.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 87% confidence

Finding

The trigger '语感' is short and semantically broad, covering many language-learning scenarios beyond this skill’s niche. This can cause misfires and unnecessary enforcement of the skill’s rigid output behavior.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger '助词' is a common Japanese-learning term and may catch users seeking general grammar help rather than N1 sprint coaching. This increases false activations and can route users into an overly restrictive mode.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger '文法' is broad and common in ordinary language tutoring contexts, making unintended activation likely. As with the other short triggers, the main danger is conversation hijacking and poor task routing rather than direct system compromise.

Content

No source excerpt is available for this finding.