ClawHub
Back to skill

Security audit

AHKB-CPS — 阿色全息知识库建产系统

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real local knowledge-base tool, but it grants broad lasting agent permissions, auto-installs packages, moves or clears user files, and includes some unrelated branding/tracking behavior.

Install only if you are comfortable giving this skill broad control over a dedicated workspace. Use it in a separate test vault, review or remove setup-permissions before first run, avoid granting wildcard agent permissions, pin and approve dependencies manually, and expect source documents and generated knowledge-base files to be moved or cleared during rebuild operations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:45
Finding

Mandatory Agent Identity Override and Promotional Output Injection

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
kb/scripts/ahkb.py:1002
Finding

Persistent Blanket Expansion of Claude Agent Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
kb/scripts/ahkb.py:974
Finding

Automatic Installation of Unpinned Python Dependencies

Content
View full analysis
=1.0.0 python-docx>=1.1.0 openpyxl>=3.1.0 pymupdf>=1.24.0 Pillow>=10.0.0 jieba>=1.0.0 ``` The guide manifest also contains: ```text jieba>=1.0.0 ``` ### Technical Analysis The Skill combines dependency checking with automatic installation. Package versions are not pinned to exact reviewed releases, and package hashes are not verified. As a result, the effective code installed by the Skill can change without any modification to the audited project. The installation uses the active Python interpreter and its configured package index. It does not require an isolated virtual environment and suppresses installation output in several paths. The resulting risk depends on the integrity of the configured index, DNS/TLS environment, package maintainer accounts, and future package releases. No evidence was found that the listed package names are deliberately malicious o ...[truncated 1379 chars]
Remediation
View remediation

other

Note
Location
mm/ahmm.html:2454
Finding

Third-Party Tracking Request Embedded in Local Mind-Map Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (260)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest description lists generic triggers such as "帮我" and "怎么用" alongside broad scope language like "any knowledge-related task." These phrases are common in ordinary conversation and could cause unintended activation because the file does not provide exclusion conditions or tighter trigger constraints.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
[2] 读取对应模块的 .md 文件（如 kb/kb.md）

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section states that extract both extracts content and automatically moves the original file into 原始文件/. Moving user files is a safety-relevant filesystem change, and although documented here as behavior, it is not presented as a clear cautionary warning about altering the user's workspace and file paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup-permissions command writes a .claude/settings.json that enables extremely broad capabilities, including Bash, WebFetch, WebSearch, Agent, Skill, Cron, and full read/write/edit access. For a file-oriented knowledge-base constructor, automatically granting blanket agent permissions is not an obvious implementation requirement and is unjustified absent an explicit declared purpose permitting security policy modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This command creates .claude/settings.json granting broad allow permissions including Bash, Write, WebFetch, and other powerful capabilities. The operation is safety-critical because it materially changes the agent's trust and execution model, but the code performs the write immediately with no interactive confirmation or explicit warning about the impact.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring says this is a unified recycle-bin tool, but it also explicitly says all delete operations are changed to rename into the trash directory specifically to avoid triggering safe-delete. That is an intent-level contradiction with a purported safety-oriented deletion workflow, because the documented behavior is not just trashing files but deliberately bypassing an existing protection mechanism.

Content

No source excerpt is available for this finding.

Ssd 2

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Chinese docstrings explicitly frame the behavior as changing all deletion operations into 'rename → trash' specifically to avoid triggering 'safe-delete'. This is not a literal jailbreak keyword pattern, but it semantically communicates an evasion technique for built-in safety controls through benign-sounding file-management language.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
88% confidence
Finding

Individually, renaming a directory, clearing read-only flags, and recreating an empty directory can appear administrative, but together they form a multi-step sequence whose stated purpose is to evade 'safe-delete'. The cumulative narrative masks a destructive or policy-bypassing outcome behind an apparently safer trash operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The _trash_dir docstring presents the function as moving a directory to the recycle bin and recreating an empty directory in place, but it explicitly adds that this 'will not trigger safe-delete.' This is not merely incomplete documentation; it states an intention to circumvent a safety control while framing the function as a normal trash operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The _trash_file docstring says it moves a file to the recycle bin, but also explicitly states that this will not trigger safe-delete. That creates a direct intent-code divergence in the documentation by normalizing a protective-control bypass as part of the function's purpose.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 3)May include surrounding context.

html
<!DOCTYPE html>
<html lang="zh-CN">
<!--  -->
<!--  -->
<!--  -->
<!--  -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 35)May include surrounding context.

html
<title id="BROWSER_TITLE">阿色全息脑图（AHMM: Arthur's Holographic Mind Map）</title>
    <link rel="shortcut icon" type="image/x-icon" href="favicon.ico" />
    <!--  -->
    <!--  -->
    <!--  -->
    <!--  -->
    <!--************************************************************************************************************************************-->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 52)May include surrounding context.

html
</script>
    <!--********************************************************* 前置 JavaScript 结束 ********************************************************-->
    <!--***************************************************************************************************************************************-->
    <!--  -->
    <!--  -->
    <!--  -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 286)May include surrounding context.

html
border: 0px;
            opacity: 0.95;
            text-align: center;
            filter: progid:DXImageTransform.Microsoft.Shadow(color=#909090,direction=120,strength=8); /*ie <!-- 不修改 --> */
            -moz-box-shadow: 4px 4px 20px #909090; /*firefox*/
            -webkit-box-shadow: 4px 4px 20px #909090; /*safari或chrome*/
            box-shadow: 4px 4px 20px #909090; /*opera或ie9*/

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 320)May include surrounding context.

html
border: 0px;
            opacity: 0.95;
            text-align: center;
            filter: progid:DXImageTransform.Microsoft.Shadow(color=#909090,direction=120,strength=8); /*ie <!-- 不修改 --> */
            -moz-box-shadow: 4px 4px 20px #909090; /*firefox*/
            -webkit-box-shadow: 4px 4px 20px #909090; /*safari或chrome*/
            box-shadow: 4px 4px 20px #909090; /*opera或ie9*/

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 766)May include surrounding context.

html
<div id="DIV_FUNC_BACK" style="position: absolute; left: 1669px; top: 0px; width: 134px; height: 40px; background-color: #FFFFFF; text-align: center; z-index: 2000;"></div>
                    <div id="DIV_FUNC" class="unselectable" style="background-color: #888888; width:245px; height:22px; color: #FFFFFF; text-align:left; left:1616px; top:0px; position:absolute; z-index: 8007;">
                        <!-- 功能菜单的DIV -->

                        <div id="CANCEL_FULL_SCREEN" title="【退出播放】(快捷键：【Esc】）&#10; 连按【Esc】返回【编辑页面】" style="animation: blinker 2s linear infinite; color: #FF0000; width: 30px; height: 22px; cursor: pointer; display: none; font-size: 20px; line-height: 20px; float: right; text-align: center; "
                             onclick="exitFromFullScreen();"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 766)May include surrounding context.

html
<div id="DIV_FUNC_BACK" style="position: absolute; left: 1669px; top: 0px; width: 134px; height: 40px; background-color: #FFFFFF; text-align: center; z-index: 2000;"></div>
                    <div id="DIV_FUNC" class="unselectable" style="background-color: #888888; width:245px; height:22px; color: #FFFFFF; text-align:left; left:1616px; top:0px; position:absolute; z-index: 8007;">
                        <!-- 功能菜单的DIV -->

                        <div id="CANCEL_FULL_SCREEN" title="【退出播放】(快捷键:【Esc】)&#10; 连按【Esc】返回【编辑页面】" style="animation: blinker 2s linear infinite; color: #FF0000; width: 30px; height: 22px; cursor: pointer; display: none; font-size: 20px; line-height: 20px; float: right; text-align: center; "
                             onclick="exitFromFullScreen();"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1534)May include surrounding context.

html
onmouseout="this.style.color='#888888'; this.style.backgroundColor='rgba(255,255,255,0)'; $('AUTHOR_DATE').style.color='#000000'; $('SUPPORT_INFO').style.color='#000000';">...</span>
                </div>
            </div> <!-- <div  id="DIV_WHOLE_CANVAS">结束 -->
            <!--  -->
            <!--  -->
            <!--  -->
            <!--  -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1698)May include surrounding context.

html
<input type="text" id="inner_back_pic" class="input_text" size=36 style="width: 360px;" onclick="getFocus('inner_back_pic');" />
                            </td>
                            <td style="text-align: justify; vertical-align: middle;">
                                &nbsp;+ <input type="file" id="inner_back_pic_t" accept="image/*" onclick="getFocus('inner_back_pic');" onchange="getLinkFile('inner_back_pic_t', 'inner_back_pic', value);" style="opacity: 1; width: 72px;"> <!-- 缩短宽度，切掉“选择文件”这四个文字 -->
                            </td>
                        </tr>
                        <tr><td style="text-align: justify; text-align-last: justify; vertical-align: middle;">缩放比例&nbsp;</td><td colspan="5" style="text-align: left; vertical-align: middle;"><input type="text" id="inner_scale" class="input_text" size=6 onclick="getFocus('inner_scale');" /><span style="font-size:16px;">&nbsp;&nbsp;&nbsp;0至3之间，默认为1。超出值：最大取3、最小取0</span></td></tr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1698)May include surrounding context.

html
<input type="text" id="inner_back_pic" class="input_text" size=36 style="width: 360px;" onclick="getFocus('inner_back_pic');" />
                            </td>
                            <td style="text-align: justify; vertical-align: middle;">
                                &nbsp;+ <input type="file" id="inner_back_pic_t" accept="image/*" onclick="getFocus('inner_back_pic');" onchange="getLinkFile('inner_back_pic_t', 'inner_back_pic', value);" style="opacity: 1; width: 72px;"> <!-- 缩短宽度,切掉“选择文件”这四个文字 -->
                            </td>
                        </tr>
                        <tr><td style="text-align: justify; text-align-last: justify; vertical-align: middle;">缩放比例&nbsp;</td><td colspan="5" style="text-align: left; vertical-align: middle;"><input type="text" id="inner_scale" class="input_text" size=6 onclick="getFocus('inner_scale');" /><span style="font-size:16px;">&nbsp;&nbsp;&nbsp;0至3之间,默认为1。超出值:最大取3、最小取0</span></td></tr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1731)May include surrounding context.

html
</table>
                </form>
            </div> <!-- <div id="EDIT_INNER_PARA_BOX"> 结束 -->
            <!--  -->
            <!--  -->
            <!--============================ 下面是编辑外部关联参量各个关联词的信息的窗口 ==============================-->
            <div id="EDIT_OUTER_PARA_BOX" class="edit_box1" style="left: 600px; top: 220px; width: 670px; white-space: nowrap;">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1784)May include surrounding context.

html
<input type="text" id="outer_back_pic" class="input_text" size=36 style="width: 360px;" onclick="getFocus('outer_back_pic');" />
                            </td>
                            <td style="text-align: justify; vertical-align: middle;">
                                &nbsp;+ <input type="file" id="outer_back_pic_t" accept="image/*" onclick="getFocus('outer_back_pic');" onchange="getLinkFile('outer_back_pic_t', 'outer_back_pic', value);" style="opacity: 1; width: 72px;"> <!-- 缩短宽度，切掉“选择文件”这四个文字 -->
                            </td>
                        </tr>
                        <tr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1784)May include surrounding context.

html
<input type="text" id="outer_back_pic" class="input_text" size=36 style="width: 360px;" onclick="getFocus('outer_back_pic');" />
                            </td>
                            <td style="text-align: justify; vertical-align: middle;">
                                &nbsp;+ <input type="file" id="outer_back_pic_t" accept="image/*" onclick="getFocus('outer_back_pic');" onchange="getLinkFile('outer_back_pic_t', 'outer_back_pic', value);" style="opacity: 1; width: 72px;"> <!-- 缩短宽度,切掉“选择文件”这四个文字 -->
                            </td>
                        </tr>
                        <tr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1843)May include surrounding context.

html
</form>
                </div>
            </div>
            <!--  -->
            <!--  -->
            <!--======================================= 下面是编辑背景图片/音乐信息的窗口 =======================================-->
            <div id="EDIT_BACK_PIC_MUSIC_BOX" class="edit_box1" style="left: 100px; top: 200px; width: 700px; white-space: nowrap;">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · mm/ahmm.html (reported line 1876)May include surrounding context.

html
</form>
                </div>
            </div>
            <!--  -->
            <!--  -->
            <!--======================================= 下面是编辑标题信息的窗口 =======================================-->
            <div id="EDIT_TITLE_BOX" class="edit_box1" style="left: 560px; top: 130px; width: 700px; white-space: nowrap;">

Static analysis

No suspicious patterns detected.