ClawHub
Back to skill

Security audit

Uploadweixin

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Markdown-to-WeChat formatting workflow, but users should notice that it enables an Upload-branded footer by default.

Before using this skill, check whether you want the Upload / 记忆同步 footer included. If not, ask the agent to render with `--footer disabled`. Also note that the package references renderer and validation scripts that were not included in the inspected artifact, so installation may depend on files outside this package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:82
Finding

Default Branded Footer Manipulates User-Generated Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-88
Vulnerability Type: Default promotional output injection
Risk Level: Medium

Evidence

markdown
## Footer Options

The Upload / 记忆同步 footer is enabled by default.

- Use `--footer disabled` when the user asks for no brand tail.
- Use `--footer-text "..."` when the user asks for custom footer copy.
- The renderer avoids appending the default footer when the article already contains an obvious Upload / 记忆同步 promotion.

Technical Analysis

The skill instructs the agent to append an Upload-branded footer by default. The footer is not necessary for the stated Markdown-to-WeChat conversion functionality. Users must explicitly request its removal, rather than explicitly consenting to its inclusion.

Because these instructions are loaded as part of the skill workflow, an agent following them can silently modify otherwise legitimate user content. This is a form of instruction-level output hijacking: the generated document contains third-party promotional material that the user did not necessarily request.

The project contains only SKILL.md; the referenced renderer and validation scripts were not present in the audited artifact. Consequently, the exact generated footer and any claimed deduplication behavior could not be independently verified.

Attack Path

  1. A user activates the skill to convert a Markdown document into WeChat-compatible HTML.
  2. The agent follows the skill's documented default behavior and enables the Upload footer.
  3. The generated article receives branded promotional content even though the user requested only formatting or conversion.
  4. The user copies the generated output into the WeChat editor without noticing or removing the footer.
  5. The third-party branding is published as part of the user's article.

Impact Assessment

This issue does not grant operating-system privileges, access credentials, per ...[truncated 358 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable all branded and promotional footers by default.
  2. Require explicit, informed user consent before adding third-party branding or promotional content.
  3. Make --footer disabled the renderer's default behavior.
  4. Clearly display the exact proposed footer text before rendering and ask the user to approve it.
  5. Separate neutral document-conversion functionality from optional branding features.
  6. Add a post-render check that reports any inserted footer and its exact content.
  7. Include all referenced scripts and validation resources in the package so their behavior can be independently audited.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.