ClawHub
Back to skill

Security audit

ilang-compress

Security checks for vulnerabilities and agentic risk

Overview

This skill only converts user prompts into a compact text notation and clearly warns users to review the notation before giving it to an execution agent.

Installers should understand that the skill produces command-like text containing words such as READ, WRIT, DEL, and @LOCAL. That text is not executable by this skill, but users should review it before pasting it into any agent or tool that might act on file, cloud, or deletion instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The manifest input phrase "Translate this document to Chinese and save it to cloud storage" reads like a normal user request rather than a narrowly scoped activation condition. Because the file does not define trigger constraints, exclusions, or alternative non-matching examples, the skill could be invoked in unintended contexts.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The example uses a broad natural-language trigger, "Read all markdown files, merge them together, and output the result," which can match a wide range of user requests and normalize bulk local file access into a simple instruction. In this skill’s context, that is risky because the compressed output explicitly expands to listing local *.md files and reading them all, which could encourage unintended invocation and overbroad data exposure if passed downstream to execution agents.

Unbounded Output

Medium
Category
Output Handling
Content
Data I/O: READ, WRIT, DEL, LIST, COPY, MOVE, STRM, CACH, SYNC, Π
Transform: Σ, Δ, φ, ∇, DEDU, ∂, CHNK, FLAT, NEST, λ, REDU, PIVT, TRNS, ENCD, DECD, ξ, ζ, EXPN, θ, FMT
Analysis: ψ, CLST, SCOR, BNCH, AUDT, VALD, CNT, μ, TRND, CORR, FRCS, ANOM
Generation: CREA, DRFT, PARA, EXPD, SHRT, STYL, TMPL, FILL
Output: Ω, DISP, EXPT, PRNT, LOG
Meta: HELP, DESC, INTR, NOOP
Confidence
80% confidence
Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Unbounded Output

Medium
Category
Output Handling
Content
Data I/O: READ, WRIT, DEL, LIST, COPY, MOVE, STRM, CACH, SYNC, Π
Transform: Σ, Δ, φ, ∇, DEDU, ∂, CHNK, FLAT, NEST, λ, REDU, PIVT, TRNS, ENCD, DECD, ξ, ζ, EXPN, θ, FMT
Analysis: ψ, CLST, SCOR, BNCH, AUDT, VALD, CNT, μ, TRND, CORR, FRCS, ANOM
Generation: CREA, DRFT, PARA, EXPD, SHRT, STYL, TMPL, FILL
Output: Ω, DISP, EXPT, PRNT, LOG
Meta: HELP, DESC, INTR, NOOP
Confidence
80% confidence
Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
Line L13 states the protocol was created by a Chinese developer. While not a direct forced-language instruction, this is the only policy-related natural-language signal in the file and may imply locale framing without offering any user choice or justification relevant to behavior.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
The skill input and output both force translation to Chinese ("to Chinese" and "lng=zh") with no indication that the user can choose another language. This creates a natural-language locale policy concern because the behavior is fixed to a specific language rather than offering user choice or documenting a justified locale restriction.

Static analysis

No suspicious patterns detected.