ClawHub
Back to skill

Security audit

老兵知识采集器

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently automates collecting public article links and importing them into a chosen IMA knowledge-base folder, with no evidence of hidden exfiltration, persistence, or destructive behavior.

Install only if you intend to use a Chinese-language workflow that searches Sogou WeChat and bulk-imports article URLs into IMA. Confirm the exact knowledge base and folder before import, review generated batches when practical, and remember imported noise may need manual cleanup because the referenced IMA interface has no delete API.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill claims to perform a controlled IMA import pipeline with idempotency, validation, and safety guardrails, but the static finding indicates the implemented behavior does not actually include the claimed import and control stages. This mismatch is dangerous because operators may trust the documented safeguards and run the skill under false assumptions, leading to uncontrolled scraping, unsafe filesystem use, or incorrect downstream actions without the promised confirmation and integrity checks.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
- 运行 `scripts/batch_search.js`：把关键词写进一个 txt（一行一词），后台跑。脚本已含会话 cookie 刷新、增量落盘、2 次重试、每词默认 2 页，并对限流做自动冷却退避。

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes reading local files, writing outputs, and making network requests, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an over-privileged, under-specified execution boundary where a host agent may grant broader capabilities than intended, increasing the chance of unintended file access or external requests. Because the skill content is operational and action-oriented, lack of scope declaration materially weakens containment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger condition includes a broad catch-all phrase that can activate on 'any' request resembling bulk knowledge-base enrichment. Overly broad activation criteria can cause the agent to invoke a networked, file-writing workflow when the user intended a discussion, planning task, or a narrower action, increasing the risk of unintended external access and content ingestion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains operational instructions exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. That creates a natural-language policy concern under the language/locale rule because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill reference is written in Chinese and does not provide any alternative language option or indicate that the skill is intentionally restricted to a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The request header hard-codes Accept-Language: zh-CN,zh;q=0.9, which enforces a specific language/locale behavior. The file does not provide any user opt-in, configurability, or documented region-specific justification for this locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring is written entirely in Chinese and provides no indication that language selection is optional or that the skill is intentionally region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring that explains the script's purpose and usage is entirely in Chinese, with no alternate language or opt-in mechanism. This can violate language/locale policy where tools should not force a specific language on users without clear justification or choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The code creates an output directory and writes wave_*.json files, but only reports the result after the writes complete. There is no prior warning, confirmation, or explicit disclosure in the script text that running it will create or overwrite files in the target directory.

Content

No source excerpt is available for this finding.