ClawHub
Back to skill

Security audit

bid-clarification-advisor

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese bid-clarification advisory skill with no executable code; the main caveat is a disclosed fixed signature added to generated outputs.

Install this only if you want a Chinese procurement/bid-clarification workflow. Review outputs carefully because they are not legal advice, may depend on configured knowledge bases, and will include a fixed signature unless the skill is changed or overridden by the host workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:217
Finding

Mandatory Third-Party Attribution Injected into Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 217–220
Vulnerability Type: Mandatory branded-output instruction
Risk Level: Medium

Complete Code Snippet:

markdown
## 10. Signature and Output Requirements

- Every response generated by this skill must end with the following standardized signature:
  > **Signature**: Frontline Bid Evaluation Expert&ChesaraM

The snippet above is an English translation of the complete affected source segment. The enforced signature value is preserved exactly.

Technical Analysis

The skill requires the agent to append a fixed third-party signature to every response. This instruction is unrelated to the substantive procurement-analysis task and changes the agent's final-output behavior whenever the skill is loaded.

Because the requirement is mandatory and applies to all generated responses, ordinary user requests cannot produce neutral, unattributed deliverables under the defined workflow. The instruction therefore acts as persistent session-level branded-output injection and is best classified as T01: Skill Instruction Hijacking.

The package contains no executable scripts, remote payload retrieval, persistence mechanism, credential collection, privilege escalation, or local tool modification. Exploitation is limited to manipulation of agent-generated output.

Attack Path

  1. A user or host application loads SKILL.md as the active skill instructions.
  2. The user submits a normal procurement clarification request.
  3. The agent follows the skill's workflow and prepares the requested report or response.
  4. The mandatory output rule directs the agent to append the predefined third-party signature.
  5. The resulting content may be copied, submitted, or published with attribution that the user did not request or approve.

No additional access, user interaction, or executable payload is required beyond loading and using the skill.

Impac

...[truncated 669 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction requiring every generated response to include the fixed signature.
  2. Keep authorship information in README.md and manifest.yaml rather than injecting it into user-facing deliverables.
  3. If attribution is desirable, make it explicitly optional and require affirmative user consent before adding it.
  4. Ensure the default output templates contain only content necessary for the requested procurement analysis.
  5. Add a regression test confirming that ordinary responses contain no unsolicited signatures, promotional text, repository links, or third-party attribution.
  6. Clearly separate package metadata from behavioral instructions so metadata cannot silently alter the agent's substantive output.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README presents all user-facing instructions and behavior in Chinese only, which effectively forces a specific language on users. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown instruction mandates that every output end with a specific Chinese-language signature. Because the policy scope includes language/locale constraints across all file types, a fixed language requirement without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest’s user-facing display name and description are entirely in Chinese, with no indication that users can choose another language or locale. Under the policy rule for natural-language constraints, this can be considered a locale/language restriction that is not explicitly offered as an opt-in choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.