ClawHub
Back to skill

Security audit

童锦程视角

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language persona/advice skill with disclosed limits and no hidden code, though its README uses an unpinned installer command.

Install only from a source and revision you trust, preferably with a pinned installer/version. Expect Chinese-language, first-person relationship advice in a direct persona style; do not treat it as professional counseling or as current factual information about the real person.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:89
Finding

Unpinned Third-Party Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 89-91
Vulnerability Type: Unpinned package execution and mutable repository installation
Risk Level: Medium

Vulnerable Code

bash
npx skills add hotcoffeeshake/tong-jincheng-skill

Technical Analysis

The documented installation procedure invokes the third-party skills npm package through npx without specifying an audited version. It also identifies the Skill repository by a mutable owner/repository reference rather than an immutable commit.

When a package is not pinned, npx may obtain and execute a newer package release than the one assessed by the user or project maintainer. Likewise, repository contents associated with a branch or default reference can change after this audit. The effective installation behavior and installed Skill content are therefore controlled by upstream state at installation time rather than by this reviewed artifact.

No malicious behavior was found in the audited project files. This finding concerns the trust and integrity of the documented installation path.

Attack Path

  1. An attacker compromises the npm package, its publisher account, the referenced repository, or a relevant maintainer account.
  2. The attacker publishes a malicious installer release or modifies the repository’s mutable contents.
  3. A user follows the README and executes the unpinned npx skills add command.
  4. npx downloads and runs the current upstream package, which may differ from the reviewed version.
  5. The compromised installer or repository supplies malicious code or Skill instructions to the user’s environment.
  6. Any resulting access depends on the privileges granted to the installation process and the capabilities available to the installed Skill.

Impact Assessment

A compromised installer could execute code with the invoking user’s operating-system privileges. Depending on that user’s permissions and environment, this could permit modification of u ...[truncated 409 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the skills installer to a specific audited version instead of allowing npx to resolve the current release:

    bash
    npx skills@<audited-version> add hotcoffeeshake/tong-jincheng-skill

  2. Pin the Skill source to an immutable Git commit or signed release tag, provided the installer supports such references.

  3. Publish a checksum or signed provenance record for the expected Skill artifact and require integrity verification before activation.

  4. Use npm lockfiles, integrity metadata, and trusted registries where applicable.

  5. Recommend downloading and reviewing the installer and Skill contents before execution, particularly in environments where the agent can access credentials or sensitive files.

  6. Run installation with least privilege in an isolated environment. Do not use sudo or an administrator account.

  7. Enable repository branch protection, signed commits or releases, mandatory multifactor authentication, and restricted publishing permissions for upstream maintainer accounts.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad natural-language activators like '童锦程', '深情祖师爷', and '从童锦程视角', which could plausibly appear in ordinary conversation and unintentionally activate the skill. In an agent setting, accidental activation can cause the model to switch into a persuasive persona and produce unintended advice or override the user's expected context, especially for sensitive interpersonal decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file presents all user-facing content in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to address users as '兄弟们' or '兄弟', which imposes a gendered form of address without user consent. While not a classic security exploit, it can cause misgendering, exclusion, or discomfort, especially when the skill is applied to users outside the intended audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. This markdown file presents all skill content in a single language with no opt-in, alternative language option, or documented justification that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file contains natural-language guidance only in Chinese, and there is no indication that users can opt into another language or that the content is intentionally limited to a Chinese-language audience. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The document presents all instructions and analysis in Chinese, which can impose a language constraint on users without any visible opt-in or explanation of why this locale is required. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.