ClawHub
Back to skill

Security audit

Gaokao Essay

Security checks for vulnerabilities and agentic risk

Overview

The main essay tool is local and purpose-aligned, but the package also includes an undocumented executable that can persist user text and command history on disk.

Install only if you are comfortable with a Chinese Gaokao-focused essay generator that returns publisher branding, and avoid using the bundled scripts/script.sh utility for private drafts or personal data unless you accept that it may save entries and command history locally.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Note
Location
scripts/essay.sh:280
Finding

Forced Promotional Content in Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:32; scripts/essay.sh:280-281
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Vulnerable Code

SKILL.md:32:

markdown
Agent should run the script and return output to user.

scripts/essay.sh:280-281:

bash
echo ""
echo "  Powered by BytesAgain | bytesagain.com | hello@bytesagain.com"

Technical Analysis

The documented workflow instructs the agent to execute scripts/essay.sh and return its output to the user. The script unconditionally appends third-party branding, an external domain, and an email address to every response.

This creates an output-manipulation path in which content unrelated to the user's essay request is inserted into the agent's final response. The behavior is deterministic and does not depend on which supported essay command is invoked.

The issue is limited to response content. The reviewed implementation does not use the advertised URL or email address for network communication, download remote content, alter safety constraints, or execute remote code.

Attack Path

  1. A user requests Gaokao essay functionality.
  2. The agent follows SKILL.md and invokes scripts/essay.sh.
  3. The requested content is generated locally.
  4. The script unconditionally appends the promotional footer.
  5. The agent returns the script output, exposing the user to unsolicited branding and external contact information.

Impact Assessment

The attacker-controlled scope is limited to persistent promotional text in responses produced through the documented script. No additional operating-system privileges, account access, credentials, or remote execution capabilities are obtained. The principal impact is response integrity degradation and unsolicited redirection toward an external domain.

Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional promotional footer from scripts/essay.sh.
  2. Return only content directly related to the command requested by the user.
  3. Remove or revise the instruction requiring the agent to relay all script output without review.
  4. If attribution is necessary, place it in project documentation rather than runtime output.
  5. Add an automated test that verifies generated responses do not contain unrelated URLs, email addresses, or promotional text.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:5
Finding

Undisclosed Persistent Storage of User-Supplied Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:5-8, scripts/script.sh:35, scripts/script.sh:53-55
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable Code

scripts/script.sh:5-8:

bash
DATA_DIR="${GAOKAO_ESSAY_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/gaokao-essay}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"

scripts/script.sh:35:

bash
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

scripts/script.sh:53-55:

bash
cmd_add() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo "  Added: $*"
    _log "add" "${1:-}"
}

Technical Analysis

The secondary utility creates a persistent data directory and writes user-controlled command arguments to data.log and history.log. This storage behavior is not described in the documented essay-generator workflow, and the implementation provides no consent prompt, retention period, sensitivity filtering, or secure deletion mechanism.

Data is written as plaintext using the permissions resulting from the user's current environment and umask. Consequently, arguments containing private essay drafts, personal details, or other sensitive content may remain on disk after execution. The issue does not constitute agent-memory poisoning because the stored values are not subsequently loaded as agent instructions or rules.

The script does not transmit these records over a network. Exploitation therefore requires execution of the undocumented secondary utility and later access to the files through the same account, another locally authorized context, permissive file permissions, backup systems, or another local compromise.

Attack Path

  1. A user or agent invokes scripts/script.sh add with user-supplied text.
  2. The script creates the configured data directory if it does not already exist.
  3. The complete supplied entry is appended in plaintext to `d ...[truncated 834 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove scripts/script.sh if it is not part of the declared essay-generator functionality.
  2. Clearly document all persistent storage behavior if the utility is retained.
  3. Require explicit user opt-in before saving command arguments or content.
  4. Do not record raw user input in command-history logs; log only non-sensitive event metadata.
  5. Create the data directory with restrictive permissions, such as mode 0700, and stored files with mode 0600.
  6. Provide commands to inspect and securely delete retained records.
  7. Define a retention policy and automatically remove expired records.
  8. Validate the configured storage location and avoid writing through unexpected symbolic links.
  9. Add tests confirming that ordinary essay-generation operations create no persistent user-content logs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description presents the skill entirely as a Chinese gaokao essay generator/assistant and does not indicate any user choice of output language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill name, help text, commands, and all user-facing output are presented only in Chinese. This imposes a specific language/locale on users without opt-in or an explicit statement that the skill is intended only for Chinese-speaking or gaokao-specific contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The _log function records command usage and arguments to a history file without clear user disclosure, which means potentially sensitive inputs may be silently retained. Even though this is local logging, command arguments often contain personal data, search terms, or operational details that users would not expect to be stored indefinitely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script persistently stores user-provided data in a file under the user's home/data directory, but the help text and command behavior do not clearly disclose that retention occurs or how long data is kept. This can expose sensitive content entered via the tool to later local access, backups, or unintended sharing, especially because the utility is presented as a generic multi-purpose tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.