Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a policy-scraping tool, but it overstates its capabilities and ships unrelated high-impact publishing/deletion instructions plus an unsafe helper script.
Install only if you are comfortable reviewing and running the scraper manually. Avoid using the bundled publishing/delete examples as agent instructions, validate numeric arguments before running shell helpers, prefer HTTPS sources where possible, and install dependencies in an isolated environment with pinned versions.
scripts/quick_scrape.sh:10Shell Arithmetic Injection Through an Unvalidated Positional Argument
SKILL.md:394Unpinned Runtime Dependency Installation Creates Supply-Chain Risk
scripts/scrape_voc_ed_policy.py:58Plaintext HTTP Scraping Allows Policy Result and Link Tampering
The English description claims broader scraping, user-controlled filtering, periodic summarization, and meaningful date-range filtering than the implementation supports, while also writing local JSON output without declared permissions. Misrepresentation of behavior is dangerous because it can hide actual data handling and lead operators to approve inappropriate capabilities.
The English description claims broader scraping, user-controlled filtering, periodic summarization, and meaningful date-range filtering than the implementation supports, while also writing local JSON output without declared permissions. Misrepresentation of behavior is dangerous because it can hide actual data handling and lead operators to approve inappropriate capabilities.
The English description claims broader scraping, user-controlled filtering, periodic summarization, and meaningful date-range filtering than the implementation supports, while also writing local JSON output without declared permissions. Misrepresentation of behavior is dangerous because it can hide actual data handling and lead operators to approve inappropriate capabilities.
The English description claims broader scraping, user-controlled filtering, periodic summarization, and meaningful date-range filtering than the implementation supports, while also writing local JSON output without declared permissions. Misrepresentation of behavior is dangerous because it can hide actual data handling and lead operators to approve inappropriate capabilities.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号
The documentation instructs users to modify SKILL.md, bump versions, and republish/overwrite the skill. Self-modification and overwrite workflows are security-sensitive because they normalize changing executable skill metadata and behavior in place, which can be abused to introduce unreviewed changes or persistence under an existing trusted slug.
3. Clean up desktop: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`
**Updating Existing Skills**:
1. Modify SKILL.md, increment version number
2. Copy to desktop and publish (using same slug)
3. System automatically overwrites previous version
Even though the path is specific, documenting recursive forced deletion in a broadly distributed skill can normalize unsafe shell practices. In this skill context, such filesystem deletion is unrelated to vocational policy scraping, so its presence increases unnecessary risk if a user copies or adapts the command incorrectly.
4. 清理桌面
rm -rf /mnt/c/Users/lenovo/Desktop/your-skill
Even though the path is specific, documenting recursive forced deletion in a broadly distributed skill can normalize unsafe shell practices. In this skill context, such filesystem deletion is unrelated to vocational policy scraping, so its presence increases unnecessary risk if a user copies or adapts the command incorrectly.
4. 清理桌面
rm -rf /mnt/c/Users/lenovo/Desktop/your-skill
This repeated forced recursive deletion command is outside the core scope of the skill and can cause accidental data loss if the example path is modified or misread. Because the skill is for policy scraping rather than local system administration, the context makes this more suspicious and less justifiable.
powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --slug existing-slug --version X.X.X"
rm -rf /mnt/c/Users/lenovo/Desktop/your-skill
### 验证发布
This repeated forced recursive deletion command is outside the core scope of the skill and can cause accidental data loss if the example path is modified or misread. Because the skill is for policy scraping rather than local system administration, the context makes this more suspicious and less justifiable.
powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --slug existing-slug --version X.X.X"
rm -rf /mnt/c/Users/lenovo/Desktop/your-skill
### 验证发布
The documented cleanup step uses a forceful recursive delete command on a host-mounted Windows path. Even though the example targets a specific directory, in an agent or copy-paste context this pattern is risky because path substitution mistakes or automation errors could delete unintended user files outside the skill's intended scope.
powershell.exe -Command "clawhub inspect your-slug"
rm -rf /mnt/c/Users/lenovo/Desktop/your-skill
**Important**: WSL cannot execute Windows binaries directly (powershell.exe, cmd.exe). Use subprocess with PowerShell commands.
The documented cleanup step uses a forceful recursive delete command on a host-mounted Windows path. Even though the example targets a specific directory, in an agent or copy-paste context this pattern is risky because path substitution mistakes or automation errors could delete unintended user files outside the skill's intended scope.
powershell.exe -Command "clawhub inspect your-slug"
rm -rf /mnt/c/Users/lenovo/Desktop/your-skill
**Important**: WSL cannot execute Windows binaries directly (powershell.exe, cmd.exe). Use subprocess with PowerShell commands.
The skill advertises behaviors that require network, file write, shell, and environment access, but it does not declare any explicit tool scope or permission boundaries. This weakens least-privilege guarantees and can cause the runtime to expose broader capabilities than users expect, especially because the documentation includes commands that read, copy, publish, and delete files.
These lines explicitly recommend maintaining a Chinese-only description because the platform forces an English display name. This creates a language-access constraint for users who do not read Chinese and does not present any opt-in or alternative locale selection at the skill-description level.
This code sets the default language to Chinese unconditionally, and the detection logic later falls back to that default if environment-based checks do not resolve to English or Chinese. That creates a locale policy issue because the skill forces a specific language choice rather than offering a user-selected or neutral default.
The fallback path returns the Chinese default whenever no supported locale is detected from environment variables. For an internationalization helper, this is a natural-language policy concern because it imposes a specific language on users who have not opted into it.
No suspicious patterns detected.