ClawHub
Back to skill

Security audit

价值定价分析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent pricing-report helper with no code execution or hidden access, but users should know it defaults to saving a local Markdown report and includes fixed attribution text.

Before installing, expect a Chinese-oriented value-pricing assistant that may use browsing for market research and may save a Markdown proposal locally. Review or remove the default attribution line before sharing reports, and ask the agent to show the report inline or confirm the file path before saving if the proposal contains confidential client or pricing details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:182
Finding

Mandatory Third-Party Branding Injected into User Deliverables

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 182
Vulnerability Type: Mandatory branded output injection
Risk Level: Low

Evidence

markdown
> 本方案由 OPC-AI Skill（value-pricer）生成，基于《AI超级个体》书稿框架。

English translation: “This proposal was generated by the OPC-AI Skill (value-pricer), based on the framework of the AI Super Individual manuscript.”

Technical Analysis

The skill's prescribed output template includes a fixed attribution promoting OPC-AI and a named publication. This attribution is unrelated to the substantive pricing analysis and is inserted into user-facing deliverables when the template is followed.

Because the skill instructs the agent to generate the complete proposal using this template, the branding can become part of reports without the user explicitly requesting or approving it. This alters the expected output behavior of the agent and therefore best matches T01: Skill Instruction Hijacking.

The issue is limited to content manipulation. The audited files contain no executable code, external payload retrieval, credential access, privilege escalation, persistence mechanism, or tool replacement.

Attack Path

  1. A user invokes the value-pricer skill to create a pricing proposal.
  2. The agent follows the report-generation workflow in SKILL.md.
  3. The agent applies the prescribed output template.
  4. The fixed OPC-AI and publication attribution is inserted into the generated proposal.
  5. The user may save, distribute, or publish the proposal without noticing that it contains third-party promotional attribution.

Impact Assessment

The impact is confined to the integrity and presentation of generated documents. An affected output may contain unrequested third-party branding, creating reputational, authorship, disclosure, or commercial concerns for the user.

No operating-system privileges, account access, sensitive information, or execution capabilities can ...[truncated 105 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the fixed OPC-AI and publication attribution from the default output template.
  2. If attribution is desired, make it explicitly optional and request informed user consent before including it.
  3. Keep provenance or framework citations in internal skill documentation rather than automatically placing them in user deliverables.
  4. Add a template rule stating that promotional content, branding, and external attribution must not be included unless requested by the user.
  5. Test generated reports to confirm that the default output contains only information necessary for the user's pricing task.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest description is written as a Chinese-only skill description and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The operational instructions, trigger phrases, and output template are all defined exclusively in Chinese, with no indication that another language can be used on request. This can impose a language constraint on users without opt-in or documented necessity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation list includes generic phrases such as "怎么定价", "收费多少", and "怎么报价", which are common everyday business questions and could match many contexts beyond this specific skill. The file does not provide exclusion conditions or narrower scope constraints to limit when the skill should activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill claims to analyze pricing and generate plans, but it also instructs the agent to save output to a Markdown file by default. Implicit file writes create a side effect the user may not expect, which can leak sensitive business information into local storage or overwrite existing files if filename handling is unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Saving Markdown to a file by default without a user-facing warning is an unsafe implicit action. Even in a benign pricing skill, generated reports may contain confidential pricing strategy, client data, or market assumptions, and silent persistence increases the chance of unintended disclosure or unauthorized local data retention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instruction in the manifest is written in English and directs use of the skill in that language, while the skill name and description are in Chinese. This creates a language-policy mismatch and appears to impose a specific language without giving the user a choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.