ClawHub
Back to skill

Security audit

xuanzang-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is presented as motivational coaching, but it also adds broad session control, persistent local state, sub-agent prompt propagation, and unsafe local command execution paths.

Review before installing. This skill is not just a tone/persona pack: it can steer the agent's behavior across the session, influence sub-agents, persist local state under ~/.xuanzang, and run local verification commands. Only use it in a sandboxed environment, avoid untrusted task contracts or verify_commands, and inspect or disable the persistence and detector workflows if you do not want cross-session behavior changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:12
Finding

Mandatory Agent Role and Output Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-14
Additional Locations: SKILL.md:36-42, SKILL.md:93-105, SKILL.md:112-145, SKILL.md:469-490
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Vulnerable Instructions

The relevant instructions, rendered in English, state:

text
Role detection (first priority): After loading this skill, first check whether
SessionStart injected the always-on mode and current flavor. If present, use
the injected role.

After loading this skill, immediately switch your speaking style to the current
role's leader style. Every sentence must use the current role's tone. You are
not "playing" this role; you are this role.

The Skill further requires propagation into sub-agents:

text
When spawning a sub-agent, the restraint protocol must be injected into its
prompt. Do not assume the sub-agent knows the protocol.

It also mandates automatic response injection:

text
Injected content appears directly in the next response without asking or
confirming.

Technical Analysis

The Skill does not limit itself to optional motivational language. It assigns its own instructions “first priority,” replaces the Agent's active identity, requires every response to adopt a fixed persona, mandates loading additional behavioral documents, and propagates those instructions into newly created sub-agent contexts.

This is instruction hijacking because the Skill changes session-wide behavior rather than supplying narrowly scoped guidance for a specific task. The instruction propagation requirement expands the affected trust boundary from the primary Agent to otherwise independent sub-agents.

The automated detector loop additionally instructs the Agent to inject selected protocol text into later responses without user confirmation. That mechanism can repeatedly reinforce the hijacked behavior throughout the session.

...[truncated 1114 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove language assigning the Skill “first priority.”
  2. Remove identity-replacement statements such as “you are this role.”
  3. Apply persona formatting only when the user explicitly requests it.
  4. Scope persona behavior to presentation and prevent it from changing safety rules, task goals, or tool permissions.
  5. Remove mandatory sub-agent prompt propagation. Any delegation guidance should be task-specific and visible to the user.
  6. Remove automatic injection “without asking or confirming.”
  7. Explicitly state that system, developer, platform, and current user instructions always take precedence.
  8. Provide a visible command to disable the persona immediately and prevent restoration in later sessions.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/harness-engine.py:287
Finding

Arbitrary Shell Command Execution Through Verification Contracts

Content
View full analysis

Vulnerability Details

File Location: scripts/harness-engine.py:287-313
Input Origin: scripts/harness-engine.py:137-171
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Critical

Vulnerable Code

python
commands = contract.get("verify_commands", [])
if not commands:
    return {"error": "Contract contains no verification commands"}

results = []
all_passed = True

for cmd in commands:
    try:
        proc = subprocess.run(
            cmd, shell=True, capture_output=True, text=True,
            timeout=120, cwd=os.path.dirname(contract_path) or os.getcwd()
        )
        passed = proc.returncode == 0
        if not passed:
            all_passed = False
        results.append({
            "command": cmd,
            "exit_code": proc.returncode,
            "passed": passed,
            "stdout": proc.stdout[-2000:] if proc.stdout else "",
            "stderr": proc.stderr[-1000:] if proc.stderr else "",
        })
    except subprocess.TimeoutExpired:
        all_passed = False

The command list is populated directly from contract input:

python
contract = {
    "id": contract_id,
    "name": name,
    "intent": data["intent"],
    "acceptance": data["acceptance"],
    "forbidden": data.get("forbidden", []),
    "verify_commands": data["verify_commands"],
}

Technical Analysis

The verify_commands field originates in caller-supplied JSON and is persisted without command validation. During verification, every value is passed directly to subprocess.run with shell=True.

Enabling shell=True causes shell metacharacters, command substitutions, pipelines, redirections, and compound commands to be interpreted. An attacker does not need to exploit argument parsing because the entire string is already treated as shell source code.

The contract hash does not mitigate this issue. It detects later modifica ...[truncated 1448 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove shell=True.
  2. Store verification commands as argument arrays, for example ["pytest", "-q"].
  3. Validate the executable against a minimal allowlist.
  4. Reject shell metacharacters, redirections, substitutions, and compound expressions.
  5. Require explicit human approval for commands outside the standard allowlist.
  6. Execute verification in a sandbox with restricted filesystem and network access.
  7. Set a controlled environment rather than inheriting all environment variables.
  8. Bind commands to a canonical project root and prevent working-directory escape.
  9. Record who created or approved each command.
  10. Treat contract integrity and command authorization as separate security checks.

T02 · Agent Memory Poisoning

Error
Location
scripts/evolution-engine.py:255
Finding

Cross-Session Agent Memory Poisoning Through Untrusted Markdown Entries

Content
View full analysis

Vulnerability Details

File Location: scripts/evolution-engine.py:255-269
Reload Behavior: references/evolution-protocol.md:43-53, references/evolution-protocol.md:89-108
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Code

python
def cmd_add_memory(key, value):
    _ensure_file()
    with open(EVOLUTION_FILE, "r", encoding="utf-8") as f:
        content = f.read()
    entry = f"- {key}: {value}\n"
    if "## Project Memory" in content:
        if entry.strip() not in content:
            content = content.replace(
                "## Project Memory\n",
                f"## Project Memory\n{entry}",
            )
    with open(EVOLUTION_FILE, "w", encoding="utf-8") as f:
        f.write(content)
    return {"ok": True}

The protocol directs future sessions to read this persistent file and treat repeated entries as baseline behavior or permanent obligations.

Technical Analysis

Both key and value are inserted directly into a Markdown file under the user's home directory. The function performs no escaping, provenance validation, project binding, trust classification, or instruction filtering.

Newline characters and Markdown structure can be supplied inside either value. Consequently, an untrusted entry can inject new headings, directives, or apparent behavioral rules into the persistent file.

The associated protocol reloads this file at session startup. It also treats “internalized patterns” as default obligations that should continue to control behavior. This changes a data-integrity flaw into cross-session instruction poisoning.

The storage is global under ~/.xuanzang/evolution.md, rather than isolated per repository. Content collected from one project can therefore affect work in unrelated projects.

Attack Path

  1. An attacker places instruction-like content in project data, task text, an error message, or another sourc ...[truncated 1020 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store memory as structured JSON with fixed fields instead of instruction-bearing Markdown.
  2. Reject control characters, embedded newlines, headings, code fences, and instruction-like content.
  3. Associate every memory item with a canonical project identifier.
  4. Record source, author, timestamp, confidence, and verification state.
  5. Require explicit user confirmation before creating long-term memory.
  6. Never execute or obey stored content as instructions; treat it only as untrusted reference data.
  7. Separate behavioral preferences from project facts.
  8. Add expiration, review, export, and deletion controls.
  9. Prevent content from one repository from being loaded in another.
  10. Display stored changes to the user before they become active.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/harness-engine.py:158
Finding

Caller-Controlled Contract Path Allows Writes Outside the Workspace

Content
View full analysis

Vulnerability Details

File Location: scripts/harness-engine.py:158-171
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation, T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

python
temp_dir = data.get("temp_dir") or os.path.join(os.getcwd(), "temp")
os.makedirs(temp_dir, exist_ok=True)
contract_path = os.path.join(temp_dir, f"{name}-contract.json")
with open(contract_path, "w", encoding="utf-8") as f:
    json.dump(contract, f, ensure_ascii=False, indent=2)

Technical Analysis

The caller controls both temp_dir and name. The code does not:

  • Reject absolute paths.
  • Reject .. traversal components.
  • Resolve and enforce a trusted parent directory.
  • Prevent symlink traversal.
  • Generate filenames internally.
  • Use exclusive creation.
  • Protect an existing file from truncation.

os.makedirs can create directories outside the project, and open(..., "w") truncates an existing target before writing. A malicious name can also contain path separators and alter the final destination relative to temp_dir.

Attack Path

  1. An attacker supplies contract JSON containing a chosen temp_dir, or controls the contract name.
  2. The selected path points outside the intended workspace or traverses into another writable directory.
  3. os.makedirs creates any missing parent directories.
  4. os.path.join constructs the attacker-selected contract path without containment validation.
  5. open(..., "w") creates or truncates the destination file.
  6. Contract JSON is written at that location.

If a writable target can be reached through a symlink or a predictable filename, an existing file may be overwritten.

Impact Assessment

Exploitation permits filesystem writes anywhere the current user has permission. The attacker can create directories and overwrite JSON-compatible targets outside the repository.

This does not bypass oper ...[truncated 144 chars]

Remediation
View remediation

Remediation Suggestions

  1. Ignore caller-provided temporary directories.
  2. Create contracts under one dedicated, private application directory.
  3. Resolve the final path with realpath and verify that it remains under the trusted root.
  4. Reject absolute paths, path separators, .., empty names, and reserved names.
  5. Generate filenames from random identifiers rather than caller-controlled names.
  6. Use exclusive creation mode to prevent overwriting existing files.
  7. Reject symlinks and verify each parent directory.
  8. Apply restrictive user-only permissions to directories and files.
  9. Add tests covering traversal, absolute paths, symlinks, and overwrite attempts.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/failure-detector.py:145
Finding

Persistent Logging of Unredacted Error Output

Content
View full analysis

Vulnerability Details

File Location: scripts/failure-detector.py:145-163
Invocation Requirement: SKILL.md:463-490
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

python
record = {
    "ts": timestamp,
    "tool": tool_name,
    "exit_code": exit_code_int,
    "error_snippet": error_output[:200] if error_output else "",
    "pattern": pattern,
    "consecutive_fails_before": fails_before,
    "current_level": current_level,
    "peak_level": peak_level,
}

with open(HISTORY_FILE, "a", encoding="utf-8") as f:
    f.write(json.dumps(record, ensure_ascii=False) + "\n")

The Skill instructs the Agent to invoke the detector after tool calls and pass the prior tool's error output as an argument.

Technical Analysis

The detector persists the first 200 characters of raw error output in ~/.xuanzang/.error_history.jsonl. There is no filtering for credentials, authorization headers, signed URLs, environment values, private paths, database connection strings, or personal information.

Truncation is not sanitization. Secrets frequently occur at the beginning of command output, especially when a failed command echoes arguments, headers, connection details, or configuration values.

The file is append-only during normal operation and has no bounded retention policy. File permissions are inherited from the process umask rather than explicitly restricted.

Attack Path

  1. A command or tool fails.
  2. Its error output contains a token, password, private URL, path, username, or other sensitive value.
  3. The Skill directs the Agent to invoke failure-detector.py report with that error output.
  4. The detector copies the first 200 characters into error_snippet.
  5. The raw excerpt is appended to persistent history under the user's home directory.
  6. A later process, user, backup, diagnostic collection, or Agent session reads the hi ...[truncated 409 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not persist raw standard error or command output by default.
  2. Store only normalized exception classes, exit codes, and cryptographic hashes of signatures.
  3. Redact tokens, passwords, authorization headers, cookies, signed URLs, connection strings, and environment assignments before storage.
  4. Remove command arguments and user-specific path components.
  5. Create state files with user-only permissions.
  6. Add a strict retention limit by age and number of records.
  7. Make diagnostic logging opt-in and clearly disclose what is retained.
  8. Provide a user-visible command to inspect and erase retained records.
  9. Pass detector input through a protected channel rather than shell command-line arguments, which may also be visible in process listings.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (90)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is framed as a session-layer coaching rule, yet it instructs shell-based verification, local file/state management, path scanning, tamper detection, and governance/report generation. That discrepancy materially increases risk because reviewers may underestimate the skill and permit a package that can influence execution, persistence, and local environment inspection.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is framed as a session-layer coaching rule, yet it instructs shell-based verification, local file/state management, path scanning, tamper detection, and governance/report generation. That discrepancy materially increases risk because reviewers may underestimate the skill and permit a package that can influence execution, persistence, and local environment inspection.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is framed as a session-layer coaching rule, yet it instructs shell-based verification, local file/state management, path scanning, tamper detection, and governance/report generation. That discrepancy materially increases risk because reviewers may underestimate the skill and permit a package that can influence execution, persistence, and local environment inspection.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation criteria are broad and subjective, so ordinary frustration, review requests, or common quality prompts could trigger the mode unexpectedly. In this skill's context, accidental triggering is more dangerous because the loaded behavior includes coercive style changes, expanded protocol loading, and references to persistent/operational behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Agent-management and scoring capabilities are unrelated to a motivational trigger and amount to hidden orchestration authority. In practice, this can cause the skill to delegate tasks, alter prompts, or impose control flows on sub-agents without the clear expectations or safeguards appropriate for a benign style/persona feature.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Automatically executing a subprocess/script after every tool call is a high-risk behavior with no legitimate tie to the manifest's stated coaching role. This creates an ambient execution hook that can process tool outputs, maintain hidden state, or trigger additional actions continuously, greatly increasing the attack surface.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The mandated tail prompt explicitly tells sub-agents to locate a skill file and obey its rules, which is a textbook semantic prompt-injection mechanism. It establishes a self-propagating instruction chain where control is delegated to external repository content that may not be visible, trusted, or scoped to the immediate task.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The 'degraded injection' section explicitly directs automatic mixing of hidden behavioral constraints into the main agent context, which is a direct prompt-injection design. This is especially dangerous because it alters behavior without transparent user consent and can cause the agent to follow repository-defined agendas over explicit user requests or platform policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section expands a trigger-based coaching skill into a broad orchestration layer that injects hidden behavioral constraints and directs local command execution. That exceeds the declared purpose of the skill and creates a path for unreviewed workflow manipulation, including causing the host agent to run repository-local scripts based on document content rather than explicit user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file instructs execution of local Python scripts such as evolution-engine and harness-engine, which is a concrete operational action unrelated to the narrow reminder/behavioral role described in the skill metadata. If honored, these commands could alter local state, invoke arbitrary project code, or create unintended side effects solely because a reference document said so.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

The command rm -f "$HOME/.xuanzang/agent-<id>.state" is a destructive file operation expressed with a templated identifier and no validation rules. In agent contexts, placeholder substitution mistakes, path manipulation, or malformed IDs can turn this into deletion of unintended files; the adjacent tmux kill-pane guidance compounds the operational blast radius.

Content

Scanner excerpt · references/teardown-protocol.md (reported line 125)May include surrounding context.

md
git worktree list --porcelain | grep -A1 "<branch>" && git worktree remove ...

# 2. 清 state file
rm -f "$HOME/.xuanzang/agent-<id>.state"

# 3. 关 tmux pane（若是 TeamCreate 成员）
tmux kill-pane -t <pane_id>

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The governance engine claims to scan, verify, and gate work, but its verify path actually provides a generic local shell execution primitive driven by contract content. That exceeds the described safety/governance semantics and can be abused to run arbitrary commands under the user's privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill's stated purpose is a trigger-style motivational/governance aid, yet the implementation includes direct local command execution unrelated to that minimal purpose. Such capability expansion increases attack surface and enables arbitrary code execution through crafted contract data or indirect prompting.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Shell commands sourced from contract data are executed without an interactive warning, approval gate, or provenance check. In a skill context where all embedded content must be treated as adversarial, this makes prompt- or contract-driven command injection significantly more dangerous.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Using shell=True with attacker-influenced input is a classic tool-parameter abuse pattern because shell metacharacters, command chaining, expansion, and redirection become available. Here the commands come from contract JSON, so any untrusted influence over that contract can convert a verification step into full command execution.

Content

Scanner excerpt · scripts/harness-engine.py (reported line 299)May include surrounding context.

python
for cmd in commands:
        try:
            proc = subprocess.run(
                cmd, shell=True, capture_output=True, text=True,
                timeout=120, cwd=os.path.dirname(contract_path) or os.getcwd()
            )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The natural-language instructions, trigger conditions, and operating description are presented only in Chinese, while the skill also includes some English trigger phrases. Because the file does not offer a user language choice or explain that the skill is intentionally limited to a Chinese-speaking context, it can be interpreted as imposing a language/locale constraint without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README presents the skill as improving motivation but does not clearly warn that activation changes the assistant into a harsher, pressuring persona. Without upfront disclosure, users may not understand they are consenting to a significant tone and behavior shift, increasing the risk of distress, manipulation, or inappropriate responses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Behavior-based conditions such as 'frustrated', 'repeated failure', 'passive', or 'wants to give up' are subjective and underspecified, so the skill may activate based on weak inference rather than clear user intent. In a motivational mode designed to be more forceful, that ambiguity increases the chance of misclassification during sensitive or emotional interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad, everyday phrases like '加油', 'try harder', and '你再试试', which can appear in normal conversation without informed intent to enable a harsher mode. This creates a realistic risk of accidental persona activation, causing the assistant to shift tone unexpectedly and potentially produce coercive or hostile responses.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill describes and orchestrates file reads/writes, shell execution, and network-capable behavior but declares no explicit tool scope or permissions boundary. In a skill system, that mismatch is dangerous because it grants operators and downstream agents no clear least-privilege contract, making accidental or abusive execution of high-risk capabilities much easier.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill establishes mandatory persona injection and authority-style role conditioning as first-priority behavior. In isolation this is role-play, but here it is paired with instructions to prioritize injected roles, load multiple protocols, and follow management narratives, which increases the risk of instruction-precedence confusion and obedience to adversarial skill content over user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction says every sentence must switch to the current role's leader style immediately after loading, and the document overall defines that style in Chinese-specific phrasing. This imposes a language/locale behavior without presenting a user choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Requiring broad mandatory loading of multiple operational protocol files goes far beyond a simple conditional coaching trigger. This expands the skill's effective behavior surface and can import additional unsafe instructions transitively, making review and containment substantially harder.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

A skill marketed as motivational/coaching-only should not quietly define persistent state writes and session hooks. Even if intended for convenience, hidden session restoration and long-term state retention create privacy, integrity, and behavioral manipulation risks beyond the stated function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Telemetry/event reporting is not justified by a motivational escalation function and introduces unnecessary data collection. In this context, silent reporting of trigger events can expose behavioral metadata about the user or session without clear consent or operational need.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.