Security audit
Security checks for vulnerabilities and agentic risk
The skill is mainly a marketplace skill-search guide, but its published artifacts expose credential-shaped secrets and include under-scoped publishing workflows that users should review before installing.
Install only after the publisher removes and rotates the exposed Clawhub and WeChat credentials, narrows activation to explicit skill-discovery requests, and separates publication/upload instructions into a properly scoped publishing skill with clear confirmation and secret-handling guidance.
发布报告_20260315.md:34Hardcoded Clawhub Bearer Token Exposed in a Publishing Script
example.md:450Hardcoded WeChat Application Credentials in a Usage Example
The document claims the skill will 'auto-trigger' from broad, ordinary user requests such as asking for papers, data analysis, or writing help. In a skill-routing ecosystem, this can cause the skill to intercept general requests that should go to more specialized skills, leading to misrouting, over-invocation, or unintended precedence over other tools. The risk is elevated because this skill is specifically about selecting other skills, so ambiguous triggers can create recursive or overly broad activation behavior.
The activation guidance says users can simply describe their need and the skill will auto-trigger, then maps generic requests directly to skill recommendations. In a skill-selection skill, this creates ambiguous invocation boundaries and increases the chance of unsolicited activation on normal user intents, which can misroute workflows and reduce user control over agent behavior.
The implicit trigger examples are broad task statements like finding papers, analyzing data, or polishing text, which commonly appear in ordinary conversation. This can cause the skill to activate when the user did not ask for marketplace navigation, leading to incorrect routing, unnecessary context capture, and interference with more appropriate domain-specific skills.
This section goes beyond skill discovery and includes direct publication workflow plus credential setup for WeChat, which is a materially sensitive external action. Combining search/recommendation with publishing behavior increases the risk of unauthorized content transmission and misuse of privileged integrations under the guise of a harmless helper skill.
The instructions display credential environment variables and pair them directly with a publishing workflow, without any safety warning about secret handling. This normalizes entering secrets into examples and increases the chance of accidental leakage through chat logs, screenshots, shell history, or copied documentation.
Plain-text credential values are embedded in setup instructions, which is a direct sensitive-data exposure pattern. Even if the values are examples, publishing realistic secrets in documentation trains unsafe behavior and may lead operators to reuse or expose actual credentials in similarly visible contexts.
The document exposes a live Clawhub bearer token in cleartext and ties it to a local config path and registry, enabling anyone with access to the file to authenticate as the publisher. In the context of a skill whose stated purpose is only marketplace search/discovery, this is especially unjustified and materially increases the chance of account compromise, unauthorized publishing, or tampering.
The documentation reveals a usable authentication token without masking or warning, which is a direct secrets-exposure issue independent of the broader skill behavior. Because bearer tokens are typically sufficient for access, disclosure can permit immediate abuse by any reader or log consumer.
The file includes sample code for authenticated API upload of a ZIP package to Clawhub, which is an administrative capability unrelated to discovery/search. Providing operational upload instructions lowers the barrier to misuse and, combined with the included token elsewhere in the file, can directly enable unauthorized publication or replacement of marketplace content.
The API upload example sends a bearer token and local ZIP contents to an external service but gives no warning that authenticated data and local files are being transmitted. This omission is dangerous because users may copy-paste and execute the snippet without understanding the sensitivity of the credential and the package contents being exfiltrated to a remote endpoint.
The file presents all user-facing instructions and examples in Chinese, but does not indicate that the skill is Chinese-only, region-specific, or that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
The post-publication test example uses a generic request about finding AI papers, which is likely to overlap with normal end-user workflows rather than uniquely testing this skill. If adopted as a trigger example, it may cause the marketplace/search skill to activate when a literature-search skill should handle the request directly, reducing routing accuracy and creating user confusion.
The README encourages natural-language triggering with generic user requests like searching literature, analyzing data, or polishing text, but it does not define clear activation boundaries. In an agent ecosystem, broad trigger phrases can cause unintended skill invocation during ordinary conversation, leading to unexpected tool use, data access, or actions the user did not explicitly authorize.
The trigger keyword tables contain broad phrases such as '搜索文献', '润色', and '画图' that overlap with common requests many unrelated skills could also match. This increases the chance of misrouting or accidental invocation, especially in multi-skill environments where vague keyword matching may trigger the wrong tool or multiple tools.
The publishing examples use broad conversational triggers like '发布这篇文章到公众号' and '创建草稿' for actions that can affect external accounts. Because these phrases are natural in normal conversation, an agent could interpret discussion or drafting assistance as authorization to publish or create remote drafts, causing unintended external transmission.
This section documents credential-based publishing workflows and environment variables for WeChat operations, but it does not prominently warn that these actions can transmit content to external services and modify account state. Users may not understand that invoking the skill could publish, create drafts, or otherwise interact with a live account, increasing the risk of accidental disclosure or unauthorized external actions.
The skill is written entirely in Chinese and presents prompts, examples, and interaction patterns without stating that it should adapt to the user's language. In multilingual environments this can override user expectations, create confusion, and increase the chance of misinterpreting instructions or consent when recommending or running other skills.
The implicit triggers are broad task descriptions like data analysis, writing, and literature search that can match ordinary user requests even when the user did not ask to discover or select skills. This can cause unintended skill activation or routing, reducing user control and potentially invoking downstream capabilities or guidance that are irrelevant or over-privileged for the request context.
The skill is described as a search/discovery helper, but the examples instruct the agent to directly invoke other skills and carry out substantive tasks such as literature search and analysis. This breaks expected scope boundaries and can cause users or downstream systems to authorize actions they did not intend from a discovery-only skill.
The example instructs publication to a WeChat draft box without warning that article content will be transmitted to an external third-party platform. Users may unknowingly expose unpublished, proprietary, or sensitive content because the data-sharing consequence is not clearly disclosed at the point of action.
These trigger terms are broad academic phrases that can match many ordinary user requests, causing the skill to activate when the user did not ask for marketplace navigation or skill discovery. Over-broad routing can misdirect requests into the wrong skill path, increasing the risk of inappropriate tool suggestions or accidental escalation into downstream actions.
Generic visualization words like '画图' and '可视化' are common task requests, not reliable signals that the user wants help finding a marketplace skill. This can cause unsafe or low-quality routing by capturing broad analytical requests and sending them to a search/selection skill instead of first clarifying the actual task.
This quick-reference skill is supposed to help users discover and select skills, but these sections go beyond routing and provide direct operational commands, including publication-related actions and shell troubleshooting steps. That increases the chance the search skill will act as an execution/playbook surface for external tools rather than a constrained selector, which can lead to unintended actions or unsafe delegation.
The publication examples instruct users how to publish content externally but provide no warning that these actions may send content to third-party platforms or make it publicly visible. In a skill-search context, surfacing such commands without consent or safety framing can facilitate accidental disclosure, unauthorized posting, or reputational damage.
This artifact documents publishing and upload procedures even though the skill metadata says the skill is for finding and selecting marketplace skills. That scope mismatch can mislead users and downstream agents into invoking administrative workflows they did not expect, increasing the risk of privileged actions being taken under the guise of a benign discovery tool.
No suspicious patterns detected.