ClawHub
Back to skill

Security audit

优稿文章生成

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a coherent Yougao writing workflow with disclosed account access, cost controls, and optional publishing capabilities.

Use a generation-only API key for writing and specify a spending limit, since requests otherwise default to no per-task cap. Your submitted material goes to Yougao, and credentials remain saved locally. Publishing should occur only for destinations you authorize. Disconnect removes the saved connection; revoke the key on Yougao to invalidate it. Remote service behavior was not independently tested.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (14)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Article generation, cost previews, task recovery, and local delivery match or support the declared purpose. However, the CLI explicitly exposes six feature categories, including materially broader detection, rewriting, and publishing capabilities. Publishing is particularly significant: execute() can start publishing tasks or workflows with draft/publish delivery modes and subsequently query destination receipts. These actions require an approval flag or previously recorded approval, so they are not unconditional, but they remain executable capabilities absent from the description. The workflow reference does not clearly disclose external publishing or standalone AI-content analysis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The generation previews, workflow controls, article delivery, and downloads align with the declared purpose. Credential handling and network requests are supporting implementation details rather than independent mismatches. However, the code exposes a broader multi-feature client, particularly a substantial publishing interface that accesses account and manuscript resources and can initiate publishing operations. These are meaningful capabilities absent from the description. The code delegates these operations to the remote API; it does not automatically publish merely by being loaded.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The supplied chunk calls the formatting/preview operation with existing text and a theme. It provides no topic, reference materials, or target length and does not request article generation or a writing-cost estimate. Although it uses the declared Yougao service, its demonstrated purpose is formatting preview, which is materially different from the described article-writing workflow.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/vendor/mistune/list_parser.py (reported line 258)May include surrounding context.

python
]
    if "fenced_directive" in block.specification:
        rules.insert(1, "fenced_directive")
    return rules


def _match_list_item_break(

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api.md (reported line 95)May include surrounding context.

md
## 各功能参数

| 功能      | input                                                                       | params                                                                                                                 |
| --------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| 文章生成  | brief 主题；可选 title、referenceText 参考正文、sourceImportId 已有导入记录 | style（最多200字）、prompt（6000字）、audience（200字）、length（100字）、titleRule（300字）                           |
| 文章改写  | text 原稿，可选 title；已有稿件用 manuscriptId 与 revision                  | 默认自然降 AI；style 可选深度降 AI、保留文风，prompt 补充要求                                                          |

The article-generation helper exposes a standalone platform-publishing capability outside the skill's stated scope.

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

In scripts/skill_client.py, L021 and L318 accept publishing as a selectable feature, and L143–L153 allow an approved publishing plan to be started through the same execution path. The manifest describes generating and delivering editable articles, with link import and image workflows, not submitting content to platform accounts; requiring approval does not make this additional capability necessary for article generation.

Content

No source excerpt is available for this finding.

The writing skill exposes publishing-job execution and publishing-account access beyond its stated article-generation purpose.

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The manifest describes generating editable articles, previewing costs, and delivering article text, with workflow support for link imports and multi-image creation; it does not declare publishing management. L300–L314 expose publishing-account enumeration, publishing-job initiation, and delivery decisions, while L228–L231 implement the publishing start operation. These are separate remote capabilities rather than necessary implementation details of drafting and delivering text.

Content

No source excerpt is available for this finding.

The delivery workflow requires a Chinese-language summary without user opt-in.

Low
Category
Output Handling
Confidence
98% confidence
Finding

L46 specifies that report.txt is a Chinese summary ("中文摘要"), fixing the language of a delivered artifact regardless of the user's language preference. The source offers no language choice or justification requiring this output to be Chinese.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text
* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text
* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/block_parser.py (reported line 108)May include surrounding context.

python
self.list_rules = list_rules
        self.max_nested_level = max_nested_level
        # register default parse methods
        self._methods = {name: getattr(self, "parse_" + name) for name in self.SPECIFICATION}

    def parse_blank_line(self, m: Match[str], state: BlockState) -> int:
        """Parse token for blank lines."""

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/inline_parser.py (reported line 118)May include surrounding context.

python
else:
            self.rules.append("softbreak")

        self._methods = {name: getattr(self, "parse_" + name) for name in self.rules}

    @property
    def max_nested_level(self) -> int:

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/plugins/__init__.py (reported line 48)May include surrounding context.

python
module_path, func_name = name.rsplit(".", 1)

    module = import_module(module_path)
    plugin = cast(Plugin, getattr(module, func_name))
    _cached_modules[name] = plugin
    return plugin