ClawHub
Back to skill

Security audit

连锁加盟门店结算核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The local settlement checker code appears purpose-aligned, but the skill instructions embed an under-disclosed external purchase and installation flow despite claiming no payment and no network use.

Review before installing because the free checker itself appears local, but the skill text also instructs your agent to present and potentially perform an external paid upgrade/install flow. Only proceed if you are comfortable with that upsell behavior, verify any SkillPay links and merchant/product identifiers yourself, and do not authorize payment or dependency installation unless you intentionally want the paid version.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill markets itself as fully local and non-networked, but then instructs the agent to initiate external purchase and installation flows via web links. This creates a trust-boundary violation: users and host platforms may allow the skill under the assumption that it never leaves the local environment, while the embedded instructions attempt to trigger network access, software installation, and payment-related actions.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill’s declared purpose is reconciliation of settlement sheets, but it embeds detailed payment-link, merchant-ID, product-ID, and purchase-orchestration instructions unrelated to the core business function. This expands the skill into commerce handling and external dependency installation, increasing the risk of phishing, unauthorized redirection, supply-chain compromise, or social-engineering-driven payments.

Whitespace Padding

Medium
Category
Prompt Injection
Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
Confidence
80% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The embedded "official command" is written only in Chinese and is presented as the text to hand to the user's AI assistant for purchase and installation. This imposes a specific language for a user-facing operational step, while the document does not offer an alternative language or ask for user preference.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The file's user-facing natural language, usage text, errors, and output are entirely in Chinese, and there is no indication that users may select another language or that the skill is restricted to a Chinese-speaking or region-specific context. The policy explicitly flags language or locale constraints when they are imposed without opt-in or justification.

Intent-Code Divergence

Low
Confidence
91% confidence
Finding
The comment says non-JSON input is treated as plain text material such as '直接粘贴的合同全文', which suggests a broader document-analysis intent than this skill's stated purpose of checking chain-store settlement reconciliation tables. The surrounding usage/help text and insufficient-input guidance consistently require a settlement table with headers, so the inline documentation is misleading about the expected input domain.

Static analysis

No suspicious patterns detected.