ClawHub
Back to skill

Security audit

Food Factory Cost Pricing

Security checks for vulnerabilities and agentic risk

Overview

The skill is a food-factory pricing assistant, but it asks for file, terminal, and web access that its documented calculator-style workflow does not need.

Review this skill before installing in environments where declared toolsets are automatically granted. Its business logic is straightforward, but it should not need terminal, file, or web access for the described pricing calculations; prefer installing only with calculator access or ask the publisher to reduce the declared permissions.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:9
Finding

Unnecessary Declaration of Privileged Toolsets

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 9
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Low

Complete Code Snippet:

yaml
requires_toolsets: [web, terminal, file, calculator]

Technical Analysis

The documented workflow only requires arithmetic operations and table formatting. No instructions in the Skill require network access, command execution, or filesystem access. Declaring the web, terminal, and file toolsets therefore violates the principle of least privilege.

The declaration does not itself contain malicious behavior. However, if the hosting platform automatically grants the listed capabilities, the Skill execution context may receive substantially broader access than its legitimate cost-calculation and pricing functions require.

Attack Path

  1. The Skill is installed or loaded by a platform that grants tool access according to requires_toolsets.
  2. The platform provides web, terminal, filesystem, and calculator capabilities.
  3. A compromised execution context, maliciously crafted input, or later unauthorized modification of the Skill invokes the unnecessary privileged tools.
  4. The excess capabilities are used to read or modify accessible files, execute local commands, or communicate with external systems.

This path is conditional on the host treating the metadata as an authorization request. The audited Skill contains no instructions that actively perform these actions.

Impact Assessment

Potentially exposed privileges include local command execution, access to files permitted to the host process, and outbound network communication. The precise scope depends on the host's sandboxing and authorization controls. In the current version, no active exploitation, credential access, persistence, or data exfiltration behavior was identified.

Remediation
View remediation

Remediation Suggestions

Replace the tool declaration with the minimum capability needed:

yaml
requires_toolsets: [calculator]

Add web, terminal, or file access only when a documented feature has a specific operational requirement for it. If broader tools are introduced later, apply explicit user approval, filesystem sandboxing, command allowlists, network destination restrictions, and per-invocation authorization.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description says the skill activates when the user mentions broad topics like 食品成本核算, 毛利率, 经销商价格, and 工厂定价, but it does not define exclusions or qualification criteria. That ambiguity increases the chance of over-activation, causing the model to apply rigid cost/pricing behavior to ordinary discussions where the user did not intend to invoke this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list contains generic business terms such as 毛利率, 出厂价, 定价模板, 成本利润, and 渠道价格 that can match many unrelated conversations. This can cause the skill to activate outside the intended food-factory scope, leading to irrelevant instruction takeover and potentially unsafe or misleading business guidance in contexts where the specialized assumptions do not apply.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

All natural-language instructions and output requirements are framed exclusively in Chinese, and the skill does not indicate that users may choose another language. Forcing a specific language without opt-in can violate language or locale policy when the skill may be used on multi-language platforms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.