ClawHub
Back to skill

Security audit

小红书违禁词·敏感词·限流词检测（离线）

Security checks for vulnerabilities and agentic risk

Overview

This skill checks selected drafts locally against a word list, with no evidence of hidden access, uploads, or publishing.

A passing result checks only the local word list and does not guarantee platform approval. Keep the list current and review drafts before publishing; the broader preflight helper referenced in the instructions is a separate skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/selftest.sh (reported line 67)May include surrounding context.

sh
env XHS_WORDLIST="${TMP}/nope.md" ${PY} scripts/check_prohibited.py "标题" "正文" ""

# 词库 / 段落配置缺失（用临时副本删文件，不动工作区）
cp -R . "${TMP}/pw-nowl" && rm -f "${TMP}/pw-nowl/references/prohibited-words.md"
check 3 "默认词库文件缺失 → 3（fail-closed）" \
  ${PY} "${TMP}/pw-nowl/scripts/check_prohibited.py" "标题" "白嫖证书" ""
cp -R . "${TMP}/pw-nosec" && rm -f "${TMP}/pw-nosec/references/sections.json"

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/selftest.sh (reported line 67)May include surrounding context.

sh
env XHS_WORDLIST="${TMP}/nope.md" ${PY} scripts/check_prohibited.py "标题" "正文" ""

# 词库 / 段落配置缺失（用临时副本删文件，不动工作区）
cp -R . "${TMP}/pw-nowl" && rm -f "${TMP}/pw-nowl/references/prohibited-words.md"
check 3 "默认词库文件缺失 → 3（fail-closed）" \
  ${PY} "${TMP}/pw-nowl/scripts/check_prohibited.py" "标题" "白嫖证书" ""
cp -R . "${TMP}/pw-nosec" && rm -f "${TMP}/pw-nosec/references/sections.json"

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/selftest.sh (reported line 70)May include surrounding context.

sh
cp -R . "${TMP}/pw-nowl" && rm -f "${TMP}/pw-nowl/references/prohibited-words.md"
check 3 "默认词库文件缺失 → 3（fail-closed）" \
  ${PY} "${TMP}/pw-nowl/scripts/check_prohibited.py" "标题" "白嫖证书" ""
cp -R . "${TMP}/pw-nosec" && rm -f "${TMP}/pw-nosec/references/sections.json"
check 3 "sections.json 缺失 → 3（fail-closed）" \
  ${PY} "${TMP}/pw-nosec/scripts/check_prohibited.py" "标题" "白嫖证书" ""

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/selftest.sh (reported line 70)May include surrounding context.

sh
cp -R . "${TMP}/pw-nowl" && rm -f "${TMP}/pw-nowl/references/prohibited-words.md"
check 3 "默认词库文件缺失 → 3（fail-closed）" \
  ${PY} "${TMP}/pw-nowl/scripts/check_prohibited.py" "标题" "白嫖证书" ""
cp -R . "${TMP}/pw-nosec" && rm -f "${TMP}/pw-nosec/references/sections.json"
check 3 "sections.json 缺失 → 3（fail-closed）" \
  ${PY} "${TMP}/pw-nosec/scripts/check_prohibited.py" "标题" "白嫖证书" ""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/wordlist.py (reported line 174)May include surrounding context.

python
}
    if word in STEM_EXPAND:
        rule.update(kind="regex", pattern=STEM_EXPAND[word])
        return rule
    kind, payload = parse_cell(word)
    rule.update(kind=kind)
    rule.update(payload)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/wordlist.py (reported line 181)May include surrounding context.

python
# 「微信 / 微信号 / vx / 卫星」这类一格多词，允许逐词定级
    if kind == "alternatives":
        rule["altLevels"] = {a: overrides.get(a, lvl) for a in rule["alts"]}
    return rule


def load(wordlist_path=None, sections_path=None):

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/wordlist.py (reported line 256)May include surrounding context.

python
"src": "补充规则",
        })

    return rules, notices, stats, errors


# ─────────────────────────── 匹配 ───────────────────────────

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.