ClawHub
Back to skill

Security audit

DeAI

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only writing editor with a disclosure inconsistency about rewriting, but no evidence of file access, code execution, persistence, credential use, or exfiltration.

Before installing, understand that this skill performs substantive rewriting of pasted drafts, not just annotation. Review all edits before use, and follow any academic, workplace, or platform disclosure rules for AI-assisted writing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly claims it 'does not generate content' while also directing the model to rewrite text by adding rhetorical questions, restructuring paragraphs, and applying platform-specific endings. This mismatch can mislead users and downstream systems about the skill's actual behavior, increasing the risk of undisclosed content generation and policy bypass in workflows that permit annotation but not substantive rewriting.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The rules section says the skill 'does not generate new content,' but other instructions require generating new wording such as questions, conclusions-first rewrites, and platform-specific endings. This internal contradiction is dangerous because it can cause reviewers, policy gates, or users to incorrectly classify the skill as low-risk editing when it actually performs generative transformation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The file presents the skill as supporting Chinese, English, Japanese, and Korean, but only the English section documents optional platform targeting and the Japanese/Korean sections provide much more limited instructions. This inconsistency can amount to a locale-policy quality issue because users of some supported languages are not given equivalent guidance or explicit choice despite the multilingual claim.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.