ClawHub
Back to skill

Security audit

达尔文.skill

Security checks for vulnerabilities and agentic risk

Overview

The skill openly optimizes other skills, but it can broadly read and change installed skill files with git commits before final per-change approval.

Install only if you want an agent to inspect and potentially modify other installed skills. Prefer running it on a named skill or reviewed allowlist first, check the generated branch and diffs before accepting changes, and avoid full-scan optimization unless you are comfortable exposing all local skill instructions to the workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)

Hidden Instructions

High
Category
Prompt Injection
Content
<style>
      @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;700;900&amp;display=swap');
    </style>
    <!-- Gradient for ratchet blocks -->
    <linearGradient id="blockGrad1" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0%" stop-color="#444444"/>
      <stop offset="100%" stop-color="#333333"/>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
letter-spacing="-2"
  >达尔文.skill</text>

  <!-- Subtitle pipeline -->
  <text
    x="80"
    y="312"
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
letter-spacing="0.3"
  >Inspired by Karpathy's autoresearch</text>

  <!-- ============================================================ -->
  <!-- RIGHT SIDE: Ratchet visualization                           -->
  <!-- 5 bars of increasing height + score labels, anchored right  -->
  <!-- ============================================================ -->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<rect x="944" y="252" width="36" height="68" rx="3" fill="url(#blockGrad2)"/>
  <text x="962" y="248" font-family="'Inter', system-ui, sans-serif" font-size="10" font-weight="600" fill="#777777" text-anchor="middle">55</text>

  <!-- Bar 3 — medium, warm brown (score ~68) -->
  <rect x="998" y="220" width="36" height="100" rx="3" fill="url(#blockGrad3)"/>
  <text x="1016" y="216" font-family="'Inter', system-ui, sans-serif" font-size="10" font-weight="600" fill="#8B5E3C" text-anchor="middle">68</text>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<rect x="1052" y="188" width="36" height="132" rx="3" fill="url(#blockGrad4)"/>
  <text x="1070" y="184" font-family="'Inter', system-ui, sans-serif" font-size="10" font-weight="600" fill="#C04020" text-anchor="middle">80</text>

  <!-- Bar 5 — tallest, brand orange (score ~92) -->
  <rect x="1106" y="152" width="36" height="168" rx="3" fill="url(#blockGrad5)"/>
  <text x="1124" y="148" font-family="'Inter', system-ui, sans-serif" font-size="12" font-weight="700" fill="#D4532B" text-anchor="middle">92</text>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- Baseline for bars -->
  <rect x="880" y="320" width="276" height="1" fill="#FFFFFF" opacity="0.12"/>

  <!-- Label below bars -->
  <text x="1018" y="344" font-family="'Inter', system-ui, sans-serif" font-size="11" font-weight="600" fill="#555555" text-anchor="middle" letter-spacing="2">SCORE PROGRESSION</text>

  <!-- Upward trend arrow on top-right -->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README states that the system edits SKILL.md files, creates git commits, and performs reverts, but it does not prominently warn users that running the skill may modify repositories. In context, this increases the risk of surprising state changes, accidental commits, or unwanted rollbacks across user-managed skill assets.

Skill Enumeration

Medium
Category
Agent Snooping
Content
```bash
# 将 SKILL.md 放入 Claude Code Skills 目录
mkdir -p ~/.claude/skills/darwin-skill
cp SKILL.md ~/.claude/skills/darwin-skill/SKILL.md
```
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# 将 SKILL.md 放入 Claude Code Skills 目录
mkdir -p ~/.claude/skills/darwin-skill
cp SKILL.md ~/.claude/skills/darwin-skill/SKILL.md
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium
Category
Agent Snooping
Content
```bash
# 将 SKILL.md 放入 Claude Code Skills 目录
mkdir -p ~/.claude/skills/darwin-skill
cp SKILL.md ~/.claude/skills/darwin-skill/SKILL.md
```

### 使用
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The example trigger phrase for full optimization is broad enough to overlap with ordinary user requests, which can cause the skill to activate in situations where the user did not intend repository-wide optimization. In this skill’s context, unintended activation is more dangerous because the documented behavior includes autonomous evaluation and modification of many SKILL.md files.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The description/frontmatter includes many broad trigger phrases such as general requests to improve, review, or score a skill. This can cause the skill to activate in situations where the user did not explicitly ask for autonomous optimization, leading to unintended file edits, git operations, and broad evaluation workflows on local skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
```
1. 确认优化范围：
   - 全部skills → 扫描 .claude/skills/*/SKILL.md
   - 指定skills → 用户指定列表
2. 创建 git 分支：auto-optimize/YYYYMMDD-HHMM
3. 初始化 results.tsv（如不存在）
Confidence
86% confidence
Finding
The skill instructs the agent to scan `.claude/skills/*/SKILL.md` when optimizing all skills, which is a form of broad local skill enumeration. In context, this can expose unrelated skill contents, expand access beyond the user's immediate request, and increase the blast radius before explicit per-target confirmation.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The rule '中文为主、简洁为上' imposes a Chinese-first output/style constraint regardless of the user's language preference. While not a direct security exploit, it can override user intent and degrade reliability or transparency during sensitive review/editing tasks, especially if users expect English or another language for auditability.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The banner hard-codes prominent user-facing text in Chinese, including the title and subtitle pipeline, without indicating that the skill is region-specific or offering a language choice. This creates a natural-language locale policy issue because the asset imposes a specific language on users by default.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The document declares lang="en" and uses English UI text, but the round labels are hard-coded in Chinese ("轮次 0" through "轮次 4"). This creates an inconsistent forced-language experience without user opt-in or documented locale justification.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This file sets `lang="en"` at L002, but the visible title and multiple rubric labels are in Chinese at L223 and throughout the body. That creates a natural-language locale policy issue because the skill output forces a specific mixed-language presentation without user opt-in or justification.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The document declares `lang="zh-CN"`, and the visible content throughout the page is written primarily in Simplified Chinese. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the restriction is explicitly documented and justified, which is not present here.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documentation claims no change becomes effective without explicit human confirmation, yet other sections describe committing modifications before that confirmation. In the context of an autonomous skill optimizer with git automation, this ambiguity can weaken approval boundaries and lead operators to assume a stronger human-in-the-loop safeguard than actually exists.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The document declares lang="zh-CN", and the visible content is written primarily in Simplified Chinese, which effectively fixes the skill presentation to a specific language/locale. The file does not offer an opt-in language choice or explain why a China-specific locale is required.

Context-Inappropriate Capability

Low
Confidence
95% confidence
Finding
The SVG imports a remote font from Google Fonts, which causes network access when the asset is rendered in some contexts. Even in a static branding asset, this can leak usage metadata, break offline operation, and introduce dependency on third-party content delivery.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The document declares lang="en" even though the content includes Chinese text, and there is no indication that the language choice is optional or region-specific. This is a natural-language locale constraint that may violate policy requiring language or locale choice unless justified.

Missing User Warnings

Low
Confidence
89% confidence
Finding
This code makes network requests to fonts.googleapis.com and fonts.gstatic.com, which transmits client metadata as part of loading the page. The file contains no visible warning, comment, or other user disclosure indicating that external network access occurs.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
This file sets the document language to `en` on L002, but the user-facing text in the body is predominantly Chinese. That is a natural-language locale mismatch and effectively forces a specific locale without opt-in or documented reason.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The page imports Google Fonts from fonts.googleapis.com, which causes the client to make an external network request and disclose metadata such as IP address, user agent, and timing information to a third party. In a local/offline-oriented skill asset this is an unnecessary privacy and supply-chain dependency, though it is not direct code execution and the overall severity remains low.

Static analysis

No suspicious patterns detected.