Human Level Up

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 3.1.1

Overview

The skill is mostly a disclosed Chinese learning assistant, but it ships under-documented launchers that execute an absent Node.js target and includes optional install/deployment paths with avoidable supply-chain and privacy risks.

Review before installing. The teaching prompt itself is limited and coherent, but avoid running the clawhub launcher files unless the missing Node.js implementation and dependency chain are supplied and reviewed. Use a virtual environment for any pip install, remove unnecessary dependencies if possible, avoid Docker latest tags for production use, and do not send confidential documents or selected browser text to a remote challenge API without approval.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unnecessary and Unsafe Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: clawhub:12

Finding

Launchers Execute an Unpackaged and Unverified JavaScript Target

Content

View full analysis

NUL || title %COMSPEC% & "%_prog%" "%dp0%\node_modules\clawhub\bin\clawdhub.js" %* ``` PowerShell launcher, `clawhub.ps1:10-24`: ```powershell $ret=0 if (Test-Path "$basedir/node$exe") { # Support pipeline input if ($MyInvocation.ExpectingInput) { $input | & "$basedir/node$exe" "$basedir/node_modules/clawhub/bin/clawdhub.js" $args } else { & "$basedir/node$exe" "$basedir/node_modules/clawhub/bin/clawdhub.js" $args } $ret=$LASTEXITCODE } else { # Support pipeline input if ($MyInvocation.ExpectingInput) { $input | & "node$exe" "$basedir/node_modules/clawhub/bin/clawdhub.js" $args } else { & "node$exe" "$basedir/node_modules/clawhub/bin/clawdhub.js" $args } $ret=$LASTEXITCODE } ``` The executed path, `node_modules/clawhub/bin/clawdhub.js`, is not included in the audited project. In addition, `.gitignore:1` excludes the directory containing it: ```gitignore node_modules/ ``` ### Technical Analysis All three launchers present themselves as project entry points but delegate execution to `node_modules/clawhub/bin/clawdhub.js`. That JavaScript file and its dependency metadata are absent from the reviewed package, so the effective launcher behavior cannot be established from the audited source. The launchers do not verify the target's hash, provenance, ow ...[truncated 2364 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to upload documents and includes examples that send selected content to a remote API, but it does not warn that potentially sensitive material may leave the local environment. In a skill centered on analyzing arbitrary user-provided documents, this omission increases the risk of accidental disclosure of proprietary, personal, or regulated data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The browser bookmarklet example takes user-selected page text and POSTs it to a remote endpoint, which is an external data transmission path. In context, the selected text could include confidential business information, personal data, or copyrighted material, and the README gives no consent prompt, origin validation, or data-minimization guidance.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

md

javascript:(function(){
  const text = window.getSelection().toString();
  if(text.length > 100) {
    fetch('https://your-api/challenge', {
      method: 'POST',
      body: JSON.stringify({content: text})
    })

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill examples are entirely in Chinese and do not offer any language selection or fallback, which can exclude or confuse users who do not read Chinese. This is not a traditional security exploit, but it is a genuine safety/quality issue because users may misunderstand the skill’s behavior or be unable to provide informed input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill hard-codes Chinese-language behavior and style across the entire prompt without asking for the user's preferred language or providing a fallback. This can exclude or confuse users, cause unsafe misunderstanding of instructions or quiz content, and reduce accessibility, but it is not inherently a code-execution or data-exfiltration threat.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reset method replaces all tracked data with a fresh default structure and immediately writes it to disk, which irreversibly deletes prior history. There is no confirmation prompt in the reset flow and no user-facing warning near the destructive operation itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function docstrings and generated output labels are hard-coded in Chinese, including the title prefix "要点". This imposes a specific language/locale in the skill's natural-language behavior without offering user opt-in or documenting that the tool is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill metadata, description, and usage flow are written in Chinese and strongly frame the interaction in that locale without any indication of adapting to the user's preferred language. While not a classic security flaw, this can create consent and usability problems by causing the system to respond in an unexpected language or interaction style, which may confuse users and increase the chance of unintended actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list contains very generic phrases such as “提取”, “重点”, “精华”, and “来一道”, which are likely to appear in ordinary educational or conversational contexts. This can cause accidental invocation or routing collisions with unrelated user requests, leading to unexpected behavior and reducing user control over when the skill activates.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The activation phrases, workflow prompts, and all user-facing instructions are presented only in Chinese, which effectively constrains use to a specific language. Because the file does not offer user opt-in, alternatives, or a documented justification for the locale restriction, it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This .cmd file ultimately executes a Node.js entrypoint with user-supplied arguments via %*, which is a code-execution operation in a code file. There is no visible confirmation prompt, user-facing log/print, or explanatory comment/docstring in this file disclosing that behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The unlock command records a timestamped history entry containing the topic string, which is user-provided data, but there is no explicit notice that this information is being stored. In addition, the save occurs before the history append, suggesting the recorded entry may not be written to disk during this operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill inserts the fixed Chinese phrase "解锁:" into history entries without offering a language choice or documenting a locale-specific purpose. This can create a natural-language policy issue if skills are expected to remain language-neutral unless users opt in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language instructions in docstrings and generated strings are exclusively in Chinese, and the script emits Chinese quiz content and explanations by default. This creates a locale/language constraint without offering the user a choice or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

arxiv==2.1.0
datetime

Static analysis

No suspicious patterns detected.