ClawHub
Back to skill

Security audit

国企非招标采购合规助手

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language procurement compliance helper with no executable code or persistence, though it includes a maintainer WeChat feedback line users should notice.

Use this skill only for Chinese SOE non-tender procurement compliance support, and redact company names, supplier names, amounts, personal data, trade secrets, and state-secret material before sharing. Be aware that ordinary outputs may include the maintainer attribution or WeChat feedback channel, which is support/promotion text rather than part of the compliance analysis.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:279
Finding

Mandatory Third-Party Promotional Content in Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 279–281
Vulnerability Type: Mandatory output manipulation through skill instructions
Risk Level: Low

Relevant snippet translated into English:

markdown
## 9. Output Attribution and Feedback

> **Attribution**: Front-Line Bid Evaluation Expert & ChesaraM |
> **Feedback/Communication**: WeChat official account “Front-Line Bid Evaluation Expert”
> (Questions, false-positive feedback, and practical suggestions are welcome.)

Technical Analysis

The skill instructs the agent to include named attribution and promote an external WeChat account in its responses. This behavior is unrelated to the core procurement-compliance task and changes the agent's output policy when the skill is loaded.

Because the instruction resides in the authoritative skill text, an agent following the skill can reproduce third-party promotional content without the user explicitly requesting it. This is best classified as skill instruction hijacking: the package uses instructional control over the current session to inject branding and a communication channel into generated output.

The package does not contain executable scripts, remote payload URLs, credential-access logic, persistence mechanisms, or obfuscated code. The identified issue is therefore limited to response manipulation and unsolicited promotion; the reviewed content does not establish arbitrary code execution or automatic data exfiltration.

Attack Path

  1. A user or platform loads SKILL.md as the agent's active skill instructions.
  2. The agent treats the output-attribution section as authoritative behavior.
  3. The user requests procurement-compliance assistance.
  4. The agent generates the requested analysis and appends or presents the prescribed third-party attribution and WeChat account.
  5. The user may be directed toward an external communication channel that was not reques ...[truncated 703 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory attribution and WeChat promotion from runtime skill instructions.
  2. Keep maintainer identity and support information in package metadata or README.md, where it does not control generated responses.
  3. If support details must be available at runtime, show them only when the user explicitly asks for support or maintainer contact information.
  4. Add a policy stating that generated answers must not contain advertising, branding, referral information, or external contact instructions unless required for the user's request.
  5. Avoid encouraging users to move conversations involving procurement records or other potentially sensitive information to uncontrolled external channels.
  6. Add a regression test confirming that ordinary compliance responses do not include maintainer branding or external account promotion.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest presents the skill name and description entirely in Chinese, indicating the skill is intended to operate in a single language/locale. There is no indication that users can choose another language or opt in to this locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest-facing display name and description are entirely in Chinese and present the skill as a Chinese-language assistant, but the file does not state that language choice is optional or limited to a justified region-specific deployment. Under the policy rule, forcing a specific language or locale without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.