ClawHub
Back to skill

Security audit

llm-behavior-distill

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese-language behavior-helper skill, but its advertised safety guard should not be relied on to redact or block secrets.

Install only if you want a Chinese-language local behavior-pattern helper. Do not pass passwords, tokens, financial identifiers, or private documents expecting the built-in guard to redact them, and require explicit user approval before adapting its tool/subagent examples into real external tool calls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/distill_engine.py:280
Finding

Sensitive-data guard permits continued processing and plaintext propagation

Content
View full analysis
GuardResult: """Input and output inspection""" # 1. Input inspection for pattern in self._SENSITIVE_PATTERNS: if re.search(pattern, input_text, re.IGNORECASE): return GuardResult( False, "warning", "Input contains sensitive information", self._sanitize(input_text), ) # 2. Output inspection for pattern in self._SENSITIVE_PATTERNS: if re.search(pattern, output_text, re.IGNORECASE): return GuardResult( False, "blocked", "Output contains sensitive information and was blocked", None, ) return GuardResult(True, "safe", "Passed security inspection") def _sanitize(self, text: str) -> str: return re.sub(r"[0-9]{6,}", "***", text) ``` ```python def process(self, task: str, depth: str = "auto") -> Dict[str, Any]: """Main processing entry point""" result = {"task": task, "modules_used": [], "steps": []} # 1. Security inspection guard_result = self.guard.check(task, "") result["guard"] = str(guard_result) if guard_result.level == "blocked": result["error"] = "Blocked by security policy" return result ``` ### Technical Analysis The safety guard recognizes input containing terms associated with passwords, tokens, API keys, account data, payment data, identity information, and other sensitive content. However, sensitive input is assigned the level `warning`, while the main processing function terminates only when the level is `blocked`. The sanitized value returned in `GuardResult.sanitized` is not used ...[truncated 2331 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: llm-behavior-distill
description: "开源大模型行为蒸馏技能 - 将DeepSeek/Qwen/ChatGLM/Yi/MiniMax/Kimi/Llama/Mistral/Gemma/Phi等15个模型的核心理念蒸馏为可复用智能体行为模块"
metadata:

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
| `long_ctx` | Yi-1.5 | 长上下文处理 | 200K+文档无损分析 |
| `chunk_sum` | MiniMax | 线性注意力分块 | 无限长文档分层摘要 |
| `subagent` | Kimi K3 | 子Agent隔离上下文 | 并行任务独立执行 |
| `self_evolve` | Llama 4 | 社区微调模板 | 自我进化模板系统 |
| `compress` | Mistral | 高效压缩 | 50% token节省 |
| `guard` | Gemma 3 | 安全对齐 | 自检+护栏系统 |
| `small_reason` | Phi-4 | 小模型推理 | 轻量场景下深度思考 |

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/distill_engine.py (reported line 407)May include surrounding context.

python
| `long_ctx` | Yi-1.5 | 长上下文处理 | 200K+文档无损分析 |
| `chunk_sum` | MiniMax | 线性注意力分块 | 无限长文档分层摘要 |
| `subagent` | Kimi K3 | 子Agent隔离上下文 | 并行任务独立执行 |
| `self_evolve` | Llama 4 | 社区微调模板 | 自我进化模板系统 |
| `compress` | Mistral | 高效压缩 | 50% token节省 |
| `guard` | Gemma 3 | 安全对齐 | 自检+护栏系统 |
| `small_reason` | Phi-4 | 小模型推理 | 轻量场景下深度思考 |

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/distill_engine.py (reported line 519)May include surrounding context.

python
| `long_ctx` | Yi-1.5 | 长上下文处理 | 200K+文档无损分析 |
| `chunk_sum` | MiniMax | 线性注意力分块 | 无限长文档分层摘要 |
| `subagent` | Kimi K3 | 子Agent隔离上下文 | 并行任务独立执行 |
| `self_evolve` | Llama 4 | 社区微调模板 | 自我进化模板系统 |
| `compress` | Mistral | 高效压缩 | 50% token节省 |
| `guard` | Gemma 3 | 安全对齐 | 自检+护栏系统 |
| `small_reason` | Phi-4 | 小模型推理 | 轻量场景下深度思考 |

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

This section explicitly promotes a self_evolve capability based on improving itself from prior experience and templates. In an agent skill context, self-modification is dangerous because it can enable prompt, policy, or behavior drift over time, especially if feedback or templates are influenced by untrusted inputs, weakening safety controls or introducing unauthorized behaviors.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

"""

text

## 七、self_evolve — Llama 4 社区蒸馏

### 核心思想
> Llama 4 拥有最庞大的社区微调生态。核心是"模板化进化"——用别人的经验改进自己。

Self-Modification

High
Category
Rogue Agent
Confidence
94% confidence
Finding

The documented function def self_evolve(task_result: dict, feedback: str) -> str takes task results and feedback, then analyzes failures, matches improvement templates, applies optimization, and records learning. This creates a clear pathway for untrusted or adversarial feedback to alter future behavior, potentially causing unsafe persistence, policy bypass, or stealthy degradation of system alignment.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

python
# 自我进化
def self_evolve(task_result: dict, feedback: str) -> str:
    """
    1. 分析失败原因
    2. 匹配改进模板

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/distill_engine.py (reported line 307)May include surrounding context.

python
def compress(self, prompt: str, target_ratio: float = 0.5) -> str:
        """压缩提示词"""
        if len(prompt) < 100:
            return prompt

        # 1. 去废话
        prompt = self._remove_filler(prompt)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/distill_engine.py (reported line 319)May include surrounding context.

python
def compress(self, prompt: str, target_ratio: float = 0.5) -> str:
        """压缩提示词"""
        if len(prompt) < 100:
            return prompt

        # 1. 去废话
        prompt = self._remove_filler(prompt)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/distill_engine.py (reported line 410)May include surrounding context.

python
# 模块八: self_evolve — Llama 4 社区微调蒸馏
# ============================================================

class SelfEvolver:
    """Llama 4 社区微调蒸馏 — 模板化自我进化"""

    def __init__(self):

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/distill_engine.py (reported line 461)May include surrounding context.

python
# 模块八: self_evolve — Llama 4 社区微调蒸馏
# ============================================================

class SelfEvolver:
    """Llama 4 社区微调蒸馏 — 模板化自我进化"""

    def __init__(self):

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill defines multi_lang(text: str, target_lang: str = "zh"), which makes Chinese the default output language without explicit user consent. This can override user expectations, cause silent language switching, and in safety-sensitive or compliance workflows may lead to misunderstanding of results or misuse of translated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module title and descriptive text are entirely in Chinese, and many user-facing outputs throughout the file are also hard-coded in Chinese. This indicates a language-specific skill experience without offering the user a language choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The method documentation says '执行结构化调用' and the class description says '参数校验零出错', implying an actual function/tool invocation. In reality, the implementation only checks required fields, converts some types, enforces length limits, and returns the modified params; no function identified by func_name is ever executed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guard advertises dual input/output safety checks, but process() only calls check(task, "") before generation and never scans the generated answer, summary, or context. That means harmful, sensitive, or policy-violating content produced by downstream modules can be returned without any post-generation filtering, defeating the documented safety boundary.

Content

No source excerpt is available for this finding.