ClawHub
Back to skill

Security audit

AI生成电商营销素材 | 千川投流素材 | 直通车图 | 节日活动图 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed marketing-asset workflow, but it also directs agents to install and upgrade tools globally, fetch unpinned packages, and steer API-token configuration to a specific regional service without enough user control.

Review before installing if you do not want an agent to install npm packages, download Node, change PATH configuration, or configure qhkit tokens. Prefer approving tool installation separately, pinning qhkit to a known version, and confirming whether you need the China iqinghu.com flow or the international AutoAGC flow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger language is overly broad and says the skill 'must' activate for common marketing-related requests, which can cause the agent to route many unrelated or only loosely related tasks into this powerful skill. In context, that matters because this skill also contains installation, configuration, and account-setup behaviors, so over-triggering can expose users to unnecessary tool execution and environment changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill significantly exceeds its stated purpose of generating marketing assets by directing the agent to install Node, globally install packages, and upgrade software on the host. This expands the agent's capabilities into package management and system modification, increasing the blast radius from content generation to arbitrary code installation and environment alteration.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which allows whatever version is current at execution time to be fetched and run. In an agent context, this creates a supply-chain risk and undermines reproducibility, especially because the fetched package can execute arbitrary install/runtime code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This duplicate finding reflects the same persistence behavior: extracting binaries into a user-controlled directory and exporting that path for later execution. In an agent setting, persistent environment mutation is dangerous because it survives beyond the asset-generation task and can affect subsequent commands or sessions.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This duplicate finding reflects the same persistence behavior: extracting binaries into a user-controlled directory and exporting that path for later execution. In an agent setting, persistent environment mutation is dangerous because it survives beyond the asset-generation task and can affect subsequent commands or sessions.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill hardcodes a China-domestic account/site flow and instructs the agent to steer users toward specific login, API-key, and environment settings without asking for locale or account preference. This can misroute credentials, cause account confusion, and push users into a vendor-specific environment that may not match their intended region or compliance expectations.

Content

No source excerpt is available for this finding.