ClawHub
Back to skill

Security audit

it-integration-solution

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Word document generator for Chinese IT integration proposals, with some documentation inconsistencies but no evidence of hidden access, exfiltration, persistence, or unsafe authority.

Install this only if you want Chinese-format enterprise IT proposal .docx generation. Review the generated table of contents behavior in Word because the documentation and code disagree on whether it is manual text or a Word TOC field.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

md
- `scripts/create_it_solution.js` — 核心创建函数库

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill's trigger phrases are broad enough to intercept common document-writing requests beyond narrowly scoped IT integration proposals. Over-broad routing can cause the agent to invoke this skill in inappropriate contexts, leading to incorrect task execution, user-intent hijacking, or application of unsuitable formatting and content templates to unrelated requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill hard-codes Chinese language and PRC enterprise formatting conventions without offering locale or language selection. In a multi-tenant or general-purpose assistant, this can override user intent, mis-handle international requests, and produce documents with incorrect linguistic or regulatory conventions, especially if the skill is auto-selected via broad triggers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L135-L142 说明目录页由 createTableOfContents() 生成，但同时写明用户需在 Word 中手动通过“引用→目录→自动目录”插入目录，这与“使用函数生成目录”的表述冲突。该矛盾在 L308 进一步加重，因其又声明“目录不使用 Word 域”，与“自动目录”机制本身相悖，导致技能意图与实际实现说明不一致。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

L136-L140 说明目录依赖 Word 自动目录并预定义 TOC1/TOC2/TOC3 样式，这通常意味着基于 Word 域生成目录；但 L308-L309 明确说“目录不使用 Word 域，采用纯文本手动目录”。这不是简单遗漏，而是对目录机制的直接相反描述，容易误导调用方对技能实际能力的判断。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file’s natural-language interface is entirely in Chinese, including the top-level usage instructions and examples, which establishes a fixed language expectation for users. The skill does not offer any language/locale choice or explain that it is intentionally limited to a China-specific or Chinese-only context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The comment at L1242 says post-processing removes the TOC SDT wrapper while preserving dirty markers so Word can update fields, but removeTOCSDT() explicitly strips all w:dirty="true" attributes at L0803-L0805. This is a direct contradiction between the documented intent and the actual XML mutation performed by the code.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

L041 规定页码格式为“第N页 / 共N页”，并明确使用 SECTIONPAGES 域；但 L302 又写明使用 PageNumber.CURRENT 和 PageNumber.TOTAL_PAGES。SECTIONPAGES 与 TOTAL_PAGES 代表不同的总页数语义，这属于文档实现意图之间的直接冲突。

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
"license": "ISC",
  "description": "",
  "dependencies": {
    "docx": "^9.7.1"
  }
}

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The inline comment at L1148 states this is a placeholder page where the user manually inserts a table of contents, but the implementation immediately calls createTableOfContents(), which constructs a real TableOfContents field object. This is an active documentation contradiction about what the code does, even though the overall feature remains within the skill's purpose.

Content

No source excerpt is available for this finding.