ClawHub
Back to skill

Security audit

专业课程方案生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed course-design assistant that reads user-provided materials, searches for trends, and generates a Word document; its main risk is ordinary local document creation and possible overwrite if misused.

Install only if you are comfortable with the skill reading templates/materials you provide, browsing/searching external sources for industry trends, and creating a local Word document. Keep generated output in a workspace folder and avoid pointing the script at important existing files.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares no permissions, yet its instructions explicitly require reading local reference files and uploaded template/material files. This creates a capability/permission mismatch that can bypass user expectations and platform controls, increasing the chance of unintended file access or over-broad data exposure during execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The public description presents the skill as a course-design assistant, but the body also invokes a script to generate and save Word documents locally, read JSON from stdin/CLI, create directories, and return file metadata. Hidden file-write and local artifact creation behavior is dangerous because users and orchestrators may approve the skill for content generation without realizing it can persist data and expose filesystem details.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The TRACE section claims there is no external dependency risk, while the skill explicitly instructs the agent to visit user-provided URLs and perform industry trend searches. This misleading trust signal can reduce scrutiny of network activity and increase the risk of SSRF-like access, malicious link retrieval, or ingestion of adversarial external content.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script writes a .docx file directly to a caller-controlled path and will overwrite an existing file via doc.save(output_file) without any explicit confirmation, overwrite guard, or safe-path restriction. In an agent/automation context, this can cause unintended file clobbering or persistence on disk, especially because the default behavior is to create files automatically and user-supplied --output is converted to an absolute path without further validation.

Static analysis

No suspicious patterns detected.