Vocational Ed Policy Scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 2.0.0

Overview

The skill mostly matches a Chinese vocational-education policy scraper, but it includes unsafe shell guidance and an unsafe helper script that warrant review before installation.

Install only if you specifically need this Chinese vocational-education policy scraper. Prefer the main Python script with simple numeric arguments, review where JSON output will be written, avoid running quick_scrape.sh with untrusted input, and do not copy the rm -rf or ClawHub publish/delete examples unless you fully understand the target path and account impact.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/quick_scrape.sh:42

Finding

Command Injection Through Unvalidated Bash Arithmetic Input

Content

View full analysis

' ``` 3. Line 10 stores the argument in `DAYS` without validation. 4. Line 42 places the value into the arithmetic loop condition. 5. Bash evaluates the crafted arithmetic expression, potentially executing embedded command-substitution behavior. 6. Any resulting command runs under the account and permissions of the user or Agent that invoked the Skill. A simpler availability attack ...[truncated 782 chars]

Remediation

View remediation

&2 exit 2 fi if (( DAYS < 1 || DAYS > 365 )); then echo "DAYS must be between 1 and 365." >&2 exit 2 fi for ((i = 0; i < DAYS; i++)); do DATE=$(date -d "$i days ago" +%Y-%m-%d) curl --fail --silent --show-error --max-time 15 \ "https://www.moe.gov.cn/jyb_xxgk/" | grep "$DATE" | grep -oP 'title="[^"]*"' | head -2 done ``` Additional hardening measures: 1. Reject signs, whitespace, arithmetic operators, variable names, array syntax, and command-substitution characters by using the strict `^[0-9]+$` allowlist. 2. Enforce a conservative upper bound to prevent excessive loops and outbound requests. 3. Add `curl` connection and total timeouts. 4. Consider downloading the target page once before the loop and searching the cached response for each date, rather than issuing one request per day. 5. Enable defensive shell options such as `set -euo pipefail`, while handling expected nonzero `grep` results appropriately. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose centers on collecting policy/application data from government education-related websites and summarizing it. The actual code chunk is solely a localization utility module, handling language detection via environment variables and loading translation strings from a local JSON file. While i18n could be a supporting utility in a larger skill, this chunk by itself does not implement or directly support the declared core behavior of scraping and summarizing policy information. Its primary purpose is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述的是一个覆盖多个政府站点、可按关键词筛选并定期汇总的职业教育政策与课题申报信息抓取能力。但代码实际只是一个快速 shell 脚本：访问教育部首页、新闻发布页和信息公开页，使用 grep 抽取包含特定文字或日期的标题。其资源范围明显更窄，功能也更基础，没有显示对人社部、各省教育厅、课题申报、通用关键词筛选或定期汇总的实现。因此描述对代码能力有明显夸大，存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

代码的核心目的与声明总体接近，确实是在抓取职业教育相关政策/项目信息，并支持关键词筛选与结果汇总保存。但声明中有几处与实际不完全一致且达到“实质性偏差”：第一，声明称支持“定期汇总”，而代码中没有定时任务、计划执行、触发器或调度机制，只能手动运行一次。第二，声明称覆盖“各省教育厅官网”，但当前静态配置仅包含教育部、人社部、北京市教委，其他省份并未实现，只是留有可扩展注释。第三，虽然代码可按标题关键词把内容归类为project/课题申报等，但并未专门抓取“课题申报信息”页面，更多是通用链接抓取加标题匹配。因此应判定为描述与实际行为存在一定不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a broader multi-source policy and application-info collection tool with keyword filtering and regular summaries. The actual code is a narrow temporary scraper for the Ministry of Education homepage only. It uses hardcoded keyword matching for link titles related to vocational education, returns limited results, and merely displays a computed date range without filtering content by publication date. There is no support for Human Resources and Social Security sources, provincial education departments, scheduled runs, or summarization. The local JSON save is an extra undeclared behavior, though relatively minor compared with the larger scope mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The specific command rm -rf /mnt/c/Users/lenovo/Desktop/your-skill is not equivalent to wiping the root filesystem, but it is still a destructive recursive delete on a user path. In a skill ecosystem, dangerous operational commands embedded in documentation are a valid security concern because they can directly cause host-side data loss when copied blindly.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md

**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`

**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The specific command rm -rf /mnt/c/Users/lenovo/Desktop/your-skill is not equivalent to wiping the root filesystem, but it is still a destructive recursive delete on a user path. In a skill ecosystem, dangerous operational commands embedded in documentation are a valid security concern because they can directly cause host-side data loss when copied blindly.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md

**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`

**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The specific command rm -rf /mnt/c/Users/lenovo/Desktop/your-skill is not equivalent to wiping the root filesystem, but it is still a destructive recursive delete on a user path. In a skill ecosystem, dangerous operational commands embedded in documentation are a valid security concern because they can directly cause host-side data loss when copied blindly.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md

**发布流程**:
1. 复制技能到 Windows 桌面: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. 使用 PowerShell 发布: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. 清理桌面: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`

**覆盖更新现有技能**:
1. 修改 SKILL.md，提升版本号

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This is the same destructive cleanup pattern in the English workflow. The issue is not malware but unsafe instruction design that could result in irreversible deletion if users mistype or broaden the path.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md

**Publishing Workflow**:
1. Copy skill to Windows Desktop: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. Publish via PowerShell: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. Clean up desktop: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`

**Updating Existing Skills**:
1. Modify SKILL.md, increment version number

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

This is the same destructive cleanup pattern in the English workflow. The issue is not malware but unsafe instruction design that could result in irreversible deletion if users mistype or broaden the path.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md

**Publishing Workflow**:
1. Copy skill to Windows Desktop: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. Publish via PowerShell: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. Clean up desktop: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`

**Updating Existing Skills**:
1. Modify SKILL.md, increment version number

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This is the same destructive cleanup pattern in the English workflow. The issue is not malware but unsafe instruction design that could result in irreversible deletion if users mistype or broaden the path.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md

**Publishing Workflow**:
1. Copy skill to Windows Desktop: `cp -r ~/.hermes/skills/your-skill /mnt/c/Users/lenovo/Desktop/`
2. Publish via PowerShell: `powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version X.X.X"`
3. Clean up desktop: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`

**Updating Existing Skills**:
1. Modify SKILL.md, increment version number

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.

md

3. Clean up desktop: `rm -rf /mnt/c/Users/lenovo/Desktop/your-skill`

**Updating Existing Skills**:
1. Modify SKILL.md, increment version number
2. Copy to desktop and publish (using same slug)
3. System automatically overwrites previous version

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Even though the target path is specific, the use of rm -rf remains hazardous and can be exploited socially by inducing users to run modified variants. The skill context matters because these commands appear as authoritative setup instructions and may be followed without sufficient scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 476)May include surrounding context.

powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version 1.0.0"

3. 清理临时文件

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

text

**注意**：如果 slug 冲突，使用 `--slug` 参数指定或使用 `clawhub skill rename`。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Even though the target path is specific, the use of rm -rf remains hazardous and can be exploited socially by inducing users to run modified variants. The skill context matters because these commands appear as authoritative setup instructions and may be followed without sufficient scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 476)May include surrounding context.

powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version 1.0.0"

3. 清理临时文件

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

text

**注意**：如果 slug 冲突，使用 `--slug` 参数指定或使用 `clawhub skill rename`。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This duplicate English example reinforces unsafe shell habits and could lead to accidental deletion of local files. The risk is amplified by placeholder substitution and the expectation that users will adapt the command to their own environment.

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version 1.0.0"

3. Clean up temp files

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

text

**Note**: If slug conflict, use `--slug` parameter or `clawhub skill rename`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This duplicate English example reinforces unsafe shell habits and could lead to accidental deletion of local files. The risk is amplified by placeholder substitution and the expectation that users will adapt the command to their own environment.

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

powershell.exe -Command "clawhub publish 'C:\Users\lenovo\Desktop\your-skill' --version 1.0.0"

3. Clean up temp files

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

text

**Note**: If slug conflict, use `--slug` parameter or `clawhub skill rename`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/clawhub-limitations-and-workflow.md (reported line 85)May include surrounding context.

4. 清理桌面

bash

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

覆盖现有技能

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/clawhub-limitations-and-workflow.md (reported line 104)May include surrounding context.

4. 清理桌面

bash

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

覆盖现有技能

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/clawhub-limitations-and-workflow.md (reported line 85)May include surrounding context.

4. 清理桌面

bash

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

覆盖现有技能

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/clawhub-limitations-and-workflow.md (reported line 104)May include surrounding context.

4. 清理桌面

bash

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

覆盖现有技能

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The notes explicitly recommend using subprocess with PowerShell commands and include destructive shell cleanup commands in the same workflow. In an agent-skill context, this can encourage implementers to wire filesystem-deleting commands into automated execution paths, where path construction mistakes or untrusted inputs could lead to unintended file deletion on the host system.

Content

Scanner excerpt · references/implementation-notes.md (reported line 254)May include surrounding context.

powershell.exe -Command "clawhub inspect your-slug"

4. Clean up

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

text

**Important**: WSL cannot execute Windows binaries directly (powershell.exe, cmd.exe). Use subprocess with PowerShell commands.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The notes explicitly recommend using subprocess with PowerShell commands and include destructive shell cleanup commands in the same workflow. In an agent-skill context, this can encourage implementers to wire filesystem-deleting commands into automated execution paths, where path construction mistakes or untrusted inputs could lead to unintended file deletion on the host system.

Content

Scanner excerpt · references/implementation-notes.md (reported line 254)May include surrounding context.

powershell.exe -Command "clawhub inspect your-slug"

4. Clean up

rm -rf /mnt/c/Users/lenovo/Desktop/your-skill

text

**Important**: WSL cannot execute Windows binaries directly (powershell.exe, cmd.exe). Use subprocess with PowerShell commands.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation describes capabilities that imply network access, local file reads/writes, shell execution, and possible environment access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the runtime to grant broader capabilities than users expect, which is risky for a scraping/publishing workflow that also includes shell commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The notes state that the platform will show a system-generated English display name and recommend accepting that English name while keeping only the description in Chinese. This imposes a specific language choice in user-visible skill labeling rather than offering a language/locale option, which fits the policy category for language or locale constraints without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module sets DEFAULT_LANG = LANG_ZH and documents this as the default behavior for the skill. This imposes a specific language when no matching environment setting is present, without offering the user an explicit language choice or opt-in, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file presents its instructions entirely in Chinese and explicitly states the document purpose in Chinese, but does not offer any language choice or explain that the skill is intentionally region- or locale-specific. The policy requires flagging language or locale constraints when a specific language is imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.