ClawHub
Back to skill

Security audit

华为管理战略专家

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Huawei strategy consulting skill with no hidden execution or persistence, but generated HTML reports may load Chart.js from a CDN.

Installers should understand this is primarily a Chinese-language Huawei strategy advisor. For confidential strategy reports, prefer generated reports that bundle charting code locally or omit remote JavaScript instead of loading Chart.js from a CDN.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:199
Finding

Unpinned Third-Party JavaScript Required in Generated HTML Reports

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 199
Vulnerability Type: Unpinned remote JavaScript dependency
Risk Level: Medium

Vulnerable Code Snippet

markdown
**Visual styling guidelines**:
- Primary color: #C00000 (Huawei red)
- Secondary: #1a1a2e (dark blue-black)
- Accent: #e8a838 (gold, representing strategy)
- Background: #fafafa
- Font: system-ui, sans-serif
- Charts: Use Chart.js CDN for radar charts
- Always include both Chinese labels and metric values
- Mobile responsive: max-width 1000px, centered

Technical Analysis

The skill directs generated HTML reports to load Chart.js from a content delivery network. It does not require an exact package version, fixed trusted URL, Subresource Integrity hash, restrictive Content Security Policy, or locally reviewed copy.

JavaScript retrieved from a CDN is executable content. Its effective behavior may change after this skill has been reviewed. If the generated report uses an unversioned or mutable CDN URL, compromise of the CDN, package publication channel, DNS path, or referenced resource could cause attacker-controlled JavaScript to execute when a user opens the report.

Exploitation depends on the generated report actually including the external script and the remote resource being compromised or substituted. The audited instruction does not itself identify a malicious CDN or contain a malicious payload.

Attack Path

  1. A user requests an interactive strategic-analysis HTML report.
  2. Following SKILL.md, the agent generates HTML containing a remote Chart.js script reference.
  3. The generated report is delivered to the user and opened in a browser.
  4. The browser contacts the external CDN and retrieves JavaScript that was not included in the audited project.
  5. An attacker who has compromised or substituted the remote resource serves modified JavaScript.
  6. The browser executes that JavaScript in the generated ...[truncated 790 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle a reviewed, exact Chart.js release locally with the generated report so it does not retrieve executable code at viewing time.
  2. If a CDN is necessary, require a fully qualified trusted URL pinned to an exact immutable version.
  3. Add a verified Subresource Integrity hash and crossorigin="anonymous" to the script element.
  4. Apply a restrictive Content Security Policy that permits scripts only from explicitly approved sources and disallows unsafe inline execution.
  5. Document that opening the report performs an external network request and obtain user approval where reports may contain sensitive business information.
  6. Consider generating charts with local, non-executable SVG or server-side rendering to eliminate the browser-side dependency.
  7. Test generated reports with network access disabled to ensure a safe fallback and prevent silent degradation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill metadata and description strongly bias the agent toward Chinese-language interaction via Chinese-only naming, description, and trigger terms, without stating that the assistant should adapt to the user's language preference. This can reduce user control and cause unexpected language switching, but it is a quality and UX issue rather than a direct security exploit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to 'Always include both Chinese labels and metric values' hard-codes Chinese in generated outputs and removes flexibility to honor user language choice. In context this is not malicious, but it can create misleading or inaccessible responses for non-Chinese users and is a genuine policy/behavioral constraint issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The entire skill content is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document is entirely written in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language or region-specific context. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The document is written entirely in Chinese and does not indicate that other languages are supported or that Chinese is a required locale for a region-specific use case. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains natural-language content exclusively in Chinese, including the title and all explanatory sections. Under the policy rule for language or locale constraints, forcing a single language without user opt-in or explicit justification can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy rule, forcing a specific language without user choice can be a policy violation.

Content

No source excerpt is available for this finding.