ClawHub
Back to skill

Security audit

Aws Wechat Article Review

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for local WeChat article review, but its own instructions under-disclose a required Python command from a sibling skill that edits draft files.

Install only if you are comfortable with a local review skill that can write article files and, at finalization time, run a Python script from a neighboring aws-wechat-article-writing skill. Review that sibling script before use, keep the suite installed from a trusted source, and run it only in the intended article workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The skill explicitly declares itself to be pure local review with no external scripts or shell usage, but later requires invoking another skill’s Python script to strip citations. This mismatch can cause operators or calling agents to grant the skill broader trust and fewer safeguards than warranted, creating a deceptive capability boundary and increasing the chance of unintended code execution from adjacent directories.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest markets the skill as a review/compliance checker, but the workflow goes beyond analysis by modifying content, stripping citations, and saving a finalized article file. This violates the principle of least surprise: a reviewer skill that silently performs content transformation can lead users or orchestration layers to permit write actions they did not intend.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The capability section states there is no shell usage, yet the workflow later mandates a command-line Python invocation. This inconsistency undermines trust in the skill’s declared execution model and may cause security controls, sandboxes, or reviewers to underestimate its ability to run local code.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.