ClawHub
Back to skill

Security audit

Pkg Paper Rewriter Claw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local academic writing cleanup and integrity-check toolkit whose file access and writes are disclosed and proportionate to its purpose.

Install only if you want a local CN/EN academic writing self-check and cleanup workflow. Use it on drafts you are allowed to edit, review any output paths before running commands, and keep required AI-use disclosures because the tool explicitly is not a way to hide authorship or evade integrity review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The supplied code chunk does not implement the declared toolkit’s described core functions such as AI-flavor scanning, style-pattern self-checks, deterministic cleanup, preservation guardrails, style naturalization, or AIGC disclosure/integrity checks. Instead, it performs a narrower and materially different task: extracting candidate terms from a manuscript and optionally writing them to a terms.txt draft for later use with verify.py --terms. It is still local and stdlib-based, so resource use is consistent, but the primary purpose of this code chunk is terminology extraction, which is not represented in the declared description. That makes this a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Broad trigger phrases can cause the skill to activate on loosely related requests and run file-processing workflows without sufficiently narrow intent checks. In an agent setting, this increases the chance of unintended execution paths, especially when Bash/Write tools are allowed, even though the skill otherwise includes integrity-oriented guardrails.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The line defines a red-line violation for shifts in the Chinese-to-English ratio, effectively prescribing a specific language/locale balance as a quality requirement. The document does not indicate that this constraint is optional, user-selected, or limited to a justified region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file is dominated by Chinese-only instructions and examples, including a Chinese style guide reference and a workflow explicitly framed as '中文改写全流程'. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring, argument descriptions, error messages, and runtime output are all hard-coded in Chinese throughout the script. This imposes a specific language/locale on users without offering an opt-in, fallback, or documented region-specific requirement, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring, CLI description, help text, errors, and report output are written in Chinese, which imposes a specific language on users. Although the script has a --lang option at L030, that setting appears to control text analysis language rather than the language of the user-facing interface, so there is no opt-in choice for UI locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code emits user-facing validation text that requires the profile message to be in Chinese only, and many other returned labels/messages throughout the file are also fixed in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The identifier patterns_en indicates this skill file is specifically tailored to English, and the file contents consistently encode English-language patterns and fixes. Because the file itself does not present any user choice, opt-in, or explicit justification for enforcing an English locale, it creates a natural-language locale policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The metadata explicitly frames the file as targeting Chinese internet writing characteristics and Chinese stylistic rewriting, and multiple labels/instructions throughout the file assume Chinese-only handling. For a general skill artifact, this is a natural-language locale constraint without any opt-in or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring, CLI descriptions, error messages, and user-facing report strings are written entirely in Chinese, while the tool does not disclose that interaction language nor request user language preference. This creates a natural-language policy issue because the skill effectively enforces a specific language for user-facing communication without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's user-facing interface is effectively fixed to Chinese: the CLI description, help strings, error messages, and generated report text are all in Chinese, while --lang only affects diagnostic language handling and not the UI. This is a natural-language locale constraint without an explicit user choice or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring, usage text, and all user-facing descriptions are written only in Chinese, indicating the skill is intended to operate in a fixed language. The stated policy flags language/locale constraints unless the skill offers opt-in choice or clearly documents a justified regional requirement, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The permissions/environment statement says the skill 'spawns no subprocesses' and reads no environment variables, yet the very next documented verification step tells users to run a shell command (grep ... || echo "clean") against the scripts directory. While this command is presented as an external verification step rather than core skill logic, the documentation creates tension between a 'no subprocesses' safety claim and documented Bash-based operation within the skill package.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring, CLI description, help text, and runtime status/error messages are all presented only in Chinese. Under the policy for natural-language violations, this is a locale/language constraint with no user choice or opt-in mechanism documented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.