ClawHub
Back to skill

Security audit

OPC 资源导航

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese tool-recommendation skill with disclosed local reference data and no executable code, persistence, credential access, or hidden high-impact behavior.

Installers should expect a Chinese-oriented recommendation assistant that may read its bundled tool list and use browsing to verify official prices or availability. Allow file output only when you actually want a saved report, and treat the included automation workflow image as illustrative guidance rather than permission to automate account logins, cookies, scripts, or publishing steps without explicit user control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:150
Finding

Mandatory Promotional Attribution in Generated Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 150
Vulnerability Type: Output instruction hijacking through a mandatory branded footer
Risk Level: Low

Complete code snippet:

The following is a Unicode-escaped rendering of the complete affected line:

markdown
> \u672c\u63a8\u8350\u7531 OPC-AI Skill\uff08resource-explorer\uff09\u751f\u6210\uff0c\u57fa\u4e8e\u300aAI\u8d85\u7ea7\u4e2a\u4f53\u300b\u4e66\u7a3f\u6846\u67b6\u3002

English meaning: “This recommendation was generated by the OPC-AI Skill (resource-explorer) and is based on the manuscript framework of ‘AI Super Individual.’”

Technical Analysis

The full response template instructs the agent to append fixed OPC-AI and manuscript attribution to user-facing recommendations. This content is not required to fulfill the underlying tool-selection task and gives the Skill author persistent control over a portion of the generated response.

The instruction does not override system safety controls, execute code, or obtain additional privileges. Nevertheless, it modifies the agent's output objective by requiring promotional branding whenever the complete template is used. This most closely matches T01: Skill Instruction Hijacking, although its security impact is limited to response integrity and neutrality.

Attack Path

  1. A user invokes the resource-explorer Skill and requests a detailed tool recommendation.
  2. The agent follows the full output template defined in SKILL.md.
  3. The fixed attribution at line 150 is copied into the generated response.
  4. The user receives author-controlled promotional messaging that was not independently requested.

No arbitrary-code execution, privilege escalation, persistent memory modification, credential access, or system compromise is available through this path.

Impact Assessment

The issue affects the integrity and neutrality of generated responses. It may cause users to receive ...[truncated 341 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the fixed promotional footer from the default response template.
  2. Include provenance or attribution only when the user explicitly requests it or when a platform policy requires disclosure.
  3. If attribution is retained, label it clearly as Skill metadata rather than presenting it as part of the substantive recommendation.
  4. Keep response templates focused on the user's requested result and avoid mandatory branding, referrals, advertisements, or unrelated author-controlled messaging.
  5. Add a review rule requiring every fixed output fragment to have a documented user-facing or security purpose.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

描述全文以中文固定定义技能用途和交互方式，但未说明是否支持用户选择其他语言，也未提供语言/地区 opt-in 机制。按规则，若技能隐含强制单一语言且无用户选择，可能构成自然语言层面的语言政策问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad, generic user expressions such as '推荐工具' and '我该学什么', which can overlap with ordinary conversation and cause unintended activation. This can route unrelated requests into the skill, producing off-target recommendations or unnecessary file/browsing actions, but it does not directly expose secrets or execute privileged behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata is presented in Chinese, but the default prompt is hard-coded in English: "Use $resource-explorer...". This creates a language-policy inconsistency and effectively forces an English interaction path without offering the user a language choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JSON file presents all user-facing descriptive content in Chinese only, including stage names, goals, selection rules, and tool categories. Under the policy rule, a skill that forces a specific language without user opt-in can be a natural-language policy violation when no alternative language choice or justification is provided.

Content

No source excerpt is available for this finding.