ClawHub
Back to skill

Security audit

Daily Brain

Security checks for vulnerabilities and agentic risk

Overview

This is a local daily puzzle skill that reads bundled questions and saves progress locally, with no hidden network, credential, or system-changing behavior found.

Installers should expect a Chinese-first daily puzzle experience that stores local training progress inside the skill directory. Review the optional cron/daily push setup before enabling it, and use the reset command only when you intend to clear progress.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
83% confidence
Finding

The description and code are related in theme: both concern daily brain-training puzzles across logic, math, memory, and word categories. However, the implementation shown is narrower than the declared experience. The script reads puzzles.json and progress.json, selects a daily puzzle by date, and emits a console prompt instructing downstream generation of an HTML card. It does not itself provide adaptive difficulty logic, real streak tracking, answer handling, or interactive card UI despite the description presenting those as active features. This is a meaningful description-behavior mismatch because several user-facing capabilities are described as implemented, while the supplied code only performs puzzle selection and prompt formatting based on preexisting data.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
**权限级别：**
- 以当前用户身份运行，不需要 sudo
- 仅读写 `data/progress.json` 一个文件
- 卸载方法：`rm -rf ~/.claude/skills/daily-brain`

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
**权限级别：**
- 以当前用户身份运行，不需要 sudo
- 仅读写 `data/progress.json` 一个文件
- 卸载方法：`rm -rf ~/.claude/skills/daily-brain`

---

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md
node scripts/stats.js

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill should trigger on generic phrases such as “逻辑题”, “数学题”, “做道题”, “word game”, and “brain teaser”. These are broad everyday requests and the file does not provide exclusion conditions beyond a separate scope section, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The activation description is explicitly written as “Trigger on” followed by a bilingual list, but the primary skill framing, examples, and operational phrasing are centered on Chinese-language invocation and daily push wording without stating that users may choose their preferred language. This can be read as a locale/language default imposed by the skill rather than an opt-in choice.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
- 不创建 cron 任务（推送由外部调度）

**权限级别：**
- 以当前用户身份运行，不需要 sudo
- 仅读写 `data/progress.json` 一个文件
- 卸载方法：`rm -rf ~/.claude/skills/daily-brain`

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's natural-language interface, including description, usage guidance, status output, and HTML-card generation instructions, is presented entirely in Chinese. This imposes a specific language on users without any opt-in, fallback, or documented justification for the locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code performs a file write to progress.json, updating user progress and history, but the script contains no user-facing warning that running it will persistently modify local data. Aside from the generic title and usage string, there is no print, comment, or prompt disclosing this state-changing behavior before the write occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's descriptive comment and all user-facing console messages are written only in Chinese, which imposes a specific language on users without offering an opt-in or alternative. The policy explicitly flags language or locale constraints unless they are optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code emits user-facing instructions, labels, and status text exclusively in Chinese, including the main usage context and generated card requirements. The policy for natural-language violations applies to all file types, and there is no opt-in, fallback, or documented justification for forcing a single language/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JSON file contains user-facing natural-language questions, explanations, and options almost entirely in Chinese, which effectively fixes the skill content to a specific language. The file does not indicate user opt-in, alternate locales, or that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file contains user-facing text and labels exclusively in Chinese, including the title, descriptions, and generated prompt content. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.