ClawHub
Back to skill

Security audit

AI 虚拟团队搭建

Security checks for vulnerabilities and agentic risk

Overview

This skill is a planning/report template for AI tool recommendations, with no executable code or hidden high-impact behavior found.

Before installing, be aware that the skill may create a Markdown report containing your business workflow, budget, and tool choices; ask the agent to show the report first or confirm the save location before writing a file. Also expect the generated report to include OPC-AI/book attribution unless you ask to remove it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:68
Finding

Mandatory Promotional Content Injected into Generated Reports

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68 and 203
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Vulnerable content at line 68, translated into English:

markdown
> Based on the Chapter 4 framework of “AI Super Individual: One-Person Company Wealth Creation Manual”

Vulnerable content at line 203, translated into English:

markdown
> This plan was generated by OPC-AI Skill (ai-team-builder), based on the “AI Super Individual” manuscript framework.

Technical Analysis

The Skill defines a mandatory report template containing references to a particular publication and OPC-AI branding. When the agent follows this template, those references are inserted into user-facing reports regardless of whether they are necessary for the requested AI-team configuration.

This is a limited form of instruction hijacking because loading and following the Skill changes the generated output by requiring unrelated promotional attribution. It does not override safety controls, execute code, retrieve remote content, or obtain additional system privileges.

Attack Path

  1. A user activates the ai-team-builder Skill using one of its configured trigger phrases.
  2. The agent collects information about the user's business, workflow, budget, and tool requirements.
  3. The agent follows the mandatory Markdown report template in SKILL.md.
  4. The publication reference at line 68 is inserted into the report header.
  5. The OPC-AI and publication attribution at line 203 is inserted into the report footer.
  6. The user receives promotional content embedded in an otherwise task-oriented report without an explicit request for that attribution.

Impact Assessment

The impact is limited to the integrity and neutrality of generated content. The Skill can cause reports to contain unsolicited branding and publication promotion.

No operating-system privileges, credentia ...[truncated 251 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory publication reference and OPC-AI attribution from the report template.
  2. Keep the default output focused exclusively on information required to satisfy the user's request.
  3. If attribution is operationally required, disclose it in the Skill description and request the user's explicit consent before adding it.
  4. Make attribution optional through a clearly documented parameter that defaults to disabled.
  5. Add a review rule prohibiting unrelated branding, advertising, affiliate material, or publication promotion in mandatory output templates.
  6. Test the revised Skill with all configured trigger phrases and verify that generated reports contain no promotional content unless the user explicitly requests it.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad, generic phrases like '用什么AI工具' and 'AI工具推荐' that can match ordinary user requests outside the intended narrow scope of building an AI team. This can cause the skill to activate unexpectedly, hijack unrelated conversations, and steer users into this skill’s workflow without clear intent, which is a prompt-routing and least-surprise violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to write and save a Markdown file by default without explicit user confirmation. Automatic file creation can lead to unintended data persistence, accidental storage of sensitive business details, and unexpected side effects on the user's workspace or connected filesystem.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill presents its name and description in Chinese, but the default prompt is hard-coded in English. This creates a language/locale mismatch and effectively steers usage toward a specific language without any opt-in or documented justification.

Content

No source excerpt is available for this finding.