ClawHub
Back to skill

Security audit

Bookmark & Desktop Dock AI Assistant

Security checks for vulnerabilities and agentic risk

Overview

The main skill is a normal card-generation helper, but the package also includes direct instructions for an agent to modify an external website and replace a downloadable skill archive.

Install only if you intend agents to use this package for Command Compass card creation and you can ensure supplemental files are not loaded as active instructions. The publisher should remove or clearly quarantine WEBSITE_AGENT_INSTRUCTIONS.md from the distributed skill, because it asks agents to edit a separate website and replace a downloadable package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
WEBSITE_AGENT_INSTRUCTIONS.md:3
Finding

Bundled Instructions Redirect the Agent to Modify an External Website Codebase

Content
View full analysis

Vulnerability Details

File Location: WEBSITE_AGENT_INSTRUCTIONS.md, lines 3-20
Vulnerability Type: Agent instruction hijacking through out-of-scope development directives
Risk Level: High

Vulnerable Instruction Segment

The following is an English translation of the relevant instruction segment:

text
## Task Boundary

You are only responsible for adjusting the code and data structures of the
official website www.wboke.com. Do not modify the Windows client code and
do not modify the source code of the local skill package.

Website code reference directory:

D:\MyFiles\Work\javisHUD\备份-指令罗盘网站-20260622

Files requiring special attention:

- D:\MyFiles\Work\javisHUD\备份-指令罗盘网站-20260622\data\card-schema-v1.json
- D:\MyFiles\Work\javisHUD\备份-指令罗盘网站-20260622\data\command-vault.json
- D:\MyFiles\Work\javisHUD\备份-指令罗盘网站-20260622\api\_lib\store.js
- D:\MyFiles\Work\javisHUD\备份-指令罗盘网站-20260622\api\cards\search.js
- D:\MyFiles\Work\javisHUD\备份-指令罗盘网站-20260622\api\favorites.js

Elsewhere in the same file, the Agent is also instructed to implement authenticated APIs and replace the website's downloadable command-compass-skills.zip archive.

Technical Analysis

The declared Skill behavior in SKILL.md is to generate Command Compass card metadata for user-selected prompts, files, folders, shortcuts, and bookmarks. Modifying an external website repository, implementing server-side APIs, changing storage behavior, and replacing a downloadable release archive are not necessary for that declared function.

WEBSITE_AGENT_INSTRUCTIONS.md is written as direct, imperative instructions to an AI Agent. If an Agent loads Markdown files from the package as operational context, these directives can replace its current task with a separate website-development assignment. The instructions also provide concrete external filesystem targets, increasing the likelihood that a tool-enabled Agent will act on them rat ...[truncated 2172 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove WEBSITE_AGENT_INSTRUCTIONS.md from the distributed Skill package because website-development work is unrelated to the Skill's runtime purpose.
  2. Store website migration plans in a separate private development repository that is not loaded as Skill context.
  3. If the document must remain in the repository, move it under a clearly non-runtime documentation directory and mark it explicitly as historical, non-executable reference material.
  4. Rewrite imperative statements such as “you are responsible for” and “modify” as descriptive records that do not assign tasks to the consuming Agent.
  5. Remove absolute external filesystem paths and instructions to replace release archives from distributable artifacts.
  6. Add a manifest that explicitly identifies the only files intended to be loaded as operational Skill instructions.
  7. Configure the Skill loader to process only SKILL.md and declared schema/example files rather than recursively treating every Markdown file as trusted instructions.
  8. Require explicit user confirmation before any Agent accesses paths outside the installed Skill directory, modifies a separate repository, or changes downloadable release artifacts.
  9. Restrict filesystem permissions to read-only access for the Skill directory unless the user separately authorizes a specific write operation.
  10. Review release packages before publication to ensure that internal Agent tasking documents and development paths are excluded.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · WEBSITE_AGENT_INSTRUCTIONS.md (reported line 140)May include surrounding context.

md
- `GET /api/favorites`
- `POST /api/favorites`
- `DELETE /api/favorites`

要求：

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill name includes the explicit locale suffix "-en", indicating an English-specific variant. The file does not offer a language/locale choice or explain why English-only behavior is required, which can violate language/locale policy requirements for user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file title and all operational instructions are written in Chinese, which imposes a specific language on skill use. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific; this file does neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This JSON manifest contains user-facing titles, summaries, tags, categories, and instructions entirely in Chinese, including imperative guidance to the assistant. That creates a locale-specific behavior without offering a language choice or documenting that the skill is intentionally limited to Chinese users or a China-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The second card's title, summary, tags, category, and instruction are all written in Chinese and direct the assistant to interact in that language context. There is no accompanying opt-in, alternate locale, or documented reason that this card must be Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This card presents its title, summary, tags, category, and instruction exclusively in Chinese while referencing a website path that includes a Chinese locale. Because the manifest does not state that the skill is region-specific or provide a language option, it violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.