ClawHub
Back to skill

Security audit

schema

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for schema markup, but it includes a Next.js example that users could copy into a site with an unsafe JSON-LD embedding pattern.

Review or fix the Next.js JSON-LD example before relying on this skill for production code: use an HTML-safe JSON serializer or escaping for values placed inside a script tag, especially when fields come from a CMS, catalog, marketplace, or API. Also be aware that the skill may read project marketing context files to improve schema accuracy.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/schema-examples.md:378
Finding

Unsafe JSON-LD Serialization May Enable Stored Cross-Site Scripting

Content
View full analysis
``` can terminate the `application/ld+json` element at the HTML-parser level. The browser may then interpret the injected markup as executable JavaScript. The non-executable MIME type of the original JSON-LD element does not prevent this because the injection first closes that element and creates a separate executable script element. This flaw is especially relevant when product details originate from a CMS, marketplace seller account, imported catalog, API, or another source not fully trusted by the application. ### Attack Path 1. An attacker obtains the ability to supply or modify a product or CMS field used in the schema object. 2. The attacker places an HTML-breaking payload containing `` in that field. 3. The application copies the malicious value into `schema`. 4. `JSON.stringify(schema)` preserves the HTML closing ...[truncated 1143 chars]
Remediation
View remediation
/g, "\\u003e") .replace(/&/g, "\\u0026") .replace(/\u2028/g, "\\u2028") .replace(/\u2029/g, "\\u2029"); } `, `<`, `>`, `&`, U+2028, and U+2029. 6. Update the documented Next.js example so users do not copy the unsafe pattern into production applications. ]]>

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/schema-examples.md (reported line 391)May include surrounding context.

md
<Head>
        <script
          type="application/ld+json"
          dangerouslySetInnerHTML={{ __html: JSON.stringify(schema) }}
        />
      </Head>
      {/* Page content */}

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description says to use the skill whenever the user wants pages to show enhanced results in Google, which is broader than explicit schema-markup requests and may overlap with many general SEO conversations. Although examples are provided, the activation boundary versus other SEO-related skills is still ambiguous enough to cause unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This manifest-style eval file explicitly expects the skill to 'trigger on casual phrasing' for the prompt 'add schema to our blog posts,' which is a broad activation pattern rather than a narrowly defined invocation. There are no constraints, explicit trigger phrases, or negative examples to clarify when the skill should and should not activate, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.