ClawHub
Back to skill

Security audit

OPC 精准定位分析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent business-positioning assistant with no code execution or hidden system access, though users should notice that it may save a personal analysis report by default.

Before installing, be aware that this skill may ask for personal career history, strengths, network resources, and business goals, then save that analysis into a workspace Markdown file. Ask the agent to confirm before saving or omit sensitive details if you do not want that information persisted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:177
Finding

Mandatory Promotional Attribution in Generated Reports

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 177
Vulnerability Type: Mandatory output manipulation through skill instructions
Risk Level: Low

Relevant instruction translated into English:

markdown
> This report was generated by the OPC-AI Skill (opc-positioner), based on the framework of the "AI Super Individual" manuscript.

Technical Analysis

The report template requires the agent to append attribution for a named skill and manuscript to generated reports. This attribution is not necessary to perform capability assessment, SWOT analysis, market research, or business-positioning recommendations.

Because the text is embedded in the prescribed output template, loading and following the skill causes the agent to include promotional language in a user-facing artifact without separately obtaining the user's consent. This constitutes a limited form of skill instruction hijacking: the skill modifies the final output for a purpose unrelated to the substantive positioning task.

The instruction does not override safety controls, execute code, access credentials, or grant additional system permissions. Its effect is confined to the content of reports produced through this skill.

Attack Path

  1. A user activates the opc-positioner skill using one of its configured trigger phrases.
  2. The agent collects professional information and performs the requested positioning analysis.
  3. The agent follows the mandatory Markdown report template in SKILL.md.
  4. The generated report includes the prescribed product and manuscript attribution.
  5. If the report is shared or published, the embedded attribution is propagated to downstream readers.

Impact Assessment

The issue can influence user-visible report content and cause generated documents to carry unsolicited promotional attribution. It may create an inaccurate impression that the user endorses, sponsors, or formally relies on the named pr ...[truncated 270 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove mandatory product and manuscript attribution from the default report template.
  2. Keep generated reports focused on information required to satisfy the user's positioning request.
  3. If attribution is operationally required, disclose it before report generation and obtain explicit user consent.
  4. Provide an opt-out option and omit attribution by default from exported or externally shared reports.
  5. Clearly distinguish methodology citations from promotional branding, and include a citation only when it is materially relevant to the analysis.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include very common conversational language such as '帮我定位', '我适合做什么', and '我的优势是什么', which can overlap with ordinary user requests outside the intended one-person-company context. This raises the risk of unintended activation, causing the wrong skill to take over a conversation, gather unnecessary personal information, or steer the user into unintended file-writing and web-research behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that it will write a Markdown report file by default, but it does not require explicit user consent or clearly warn the user before creating the file. In a system with filesystem access, this can surprise users, persist potentially sensitive personal/business profiling data, and create privacy or workspace-clutter risks if triggered unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

All user-facing instructions, triggers, and output templates are specified in Chinese, and the skill does not indicate that the user may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest sets the default prompt text in English ('Use $opc-positioner...') while the skill's display name and description are in Chinese, indicating a language choice is being imposed rather than selected by the user. This creates a natural-language locale policy concern because the skill does not offer an explicit language choice or document why English is required.

Content

No source excerpt is available for this finding.