ClawHub
Back to skill

Security audit

风景一个人看，故事两个人讲

Security checks for vulnerabilities and agentic risk

Overview

The skill’s location searches, optional posting, and liking are purpose-aligned and user-controlled, despite minor documentation inconsistencies.

Connecting PowPop authorizes interaction with that service. Review the location, text, and attached images before approving publication, and remember that liking an expired post can extend its visibility by 24 hours. Nearby search results may omit posts with different place labels.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

The search workflow excludes nearby posts based on place-name text despite the manifest's distance-based definition of the same location.

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The manifest at L005 defines the same location by distance (within 500 meters), not matching place names. L135 nevertheless requires each nonempty candidate location name to contain the query's core place-name text, excluding otherwise valid nearby posts labeled with a different street or landmark. This makes textual naming a mandatory eligibility condition rather than merely rejecting demonstrably contradictory locations.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · locales/README.md (reported line 3)May include surrounding context.

md
# locales · 多语言

本目录存放 `SKILL.md` 的各语言全文。**`skills/powpop-two-stories/SKILL.md`（中文）是 canonical**，这里只放它的等价译本。

| 语言 | 文件 | 状态 |
|---|---|---|

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · locales/README.md (reported line 18)May include surrounding context.

  1. 建 locales/<lang>/SKILL.md（<lang> 用 BCP 47，如 ja、zh-TW、es）。
  2. frontmatter 必须带：name（与 canonical 完全一致，不要翻译）、version（与 canonical 一致）、language: <lang>、canonical: ../../SKILL.md、display_name、description_zh、description_en。
  3. 在 skills/powpop-two-stories/SKILL.md 的 frontmatter locales: 列表里加上这门语言。
  4. 跑校验：
bash

The workflow can publish new location-tagged posts, although the manifest describes discovering and comparing posts after publication.

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

L076 directs the agent to use prepare_post and publish_post, and L090–L095 define publication of text and images with a required location. This adds a public-write operation beyond the manifest's discovery, comparison, and optional liking workflow, and contradicts L032–L037's assurance that liking is the only outward action. Explicit publication consent mitigates unauthorized execution but does not resolve the scope mismatch.

Content

No source excerpt is available for this finding.

The same-place filter requires a matching place-name substring despite the manifest defining sameness by distance.

Low
Category
Excessive Agency
Confidence
98% confidence
Finding

The manifest at L005 says posts within 500 metres count as the same place regardless of whether their place names match. L123 instead discards any nonempty location_name lacking the requested place's core word, excluding geographically valid posts with alternate landmark names or naming conventions. This makes textual name matching an additional eligibility condition rather than merely checking for genuinely contradictory locations.

Content

No source excerpt is available for this finding.