ClawHub
Back to skill

Security audit

虚拟论坛

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed virtual-debate skill, but it needs Review because it reads local skill files and sends their full contents to external Claude CLI processes with weak scoping controls.

Install only if you are comfortable with selected local Skill files and debate prompts being sent to the Claude provider through your local Claude Code setup. Review participant Skill files for secrets or private instructions first, run the bash script only in a contained workspace, and avoid broad/casual activation until the skill has explicit consent, redaction, and tighter permission controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
subagent-arena.js:166
Finding

Untrusted Skill Content Is Embedded Directly in Privileged System Prompts

Content
View full analysis
Remediation
View remediation
... ``` 6. Do not rely on delimiters alone. Enforce tool restrictions at the runtime level and run debate participants without filesystem, shell, network, memory, or session-management tools unless strictly necessary. 7. Apply length limits and validation to topics, participant names, Skill content, and debate responses. 8. Sanitize or summarize participant responses before including them in another agent's context. 9. Avoid passing raw debate history to privileged moderator prompts. 10. Maintain an allowlist of approved Skill directories and trusted Skill identifiers. 11. Record the origin and integrity hash of every loaded Skill. 12. Add adversarial tests with Skills containing instruction overrides, fake system messages, tool-use requests, data-exfiltration requests, and cross-agent propagation payloads. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
v5/debate_parallel.sh:23
Finding

Predictable Shared Temporary Files Permit Local Symlink and Race Attacks

Content
View full analysis
/dev/null exit $exit_code } # 注册清理函数 trap cleanup EXIT INT TERM ``` The history file is created using the process ID: ```bash # 初始化对话历史 HISTORY_FILE="/tmp/debate_history_$$.txt" echo "" > "$HISTORY_FILE" ``` Participant responses are written to similarly predictable paths: ```bash # 特朗普 ( SYSTEM_PROMPT="$TRUMP_PROMPT" call_claude "$USER_MSG" >> /tmp/trump_resp_$$.txt ) & local trump_pid=$! # 内塔尼亚胡 ( SYSTEM_PROMPT="$NETANYAHU_PROMPT" call_claude "$USER_MSG" >> /tmp/netanyahu_resp_$$.txt ) & local netanyahu_pid=$! # 佩泽希齐扬 ( SYSTEM_PROMPT="$PEZESHKIAN_PROMPT" call_claude "$USER_MSG" >> /tmp/pezeshkian_resp_$$.txt ) & local pezeshkian_pid=$! # 万斯 ( SYSTEM_PROMPT="$VANCE_PROMPT" call_claude "$USER_MSG" >> /tmp/vance_resp_$$.txt ) & local vance_pid=$! # 普京 ( SYSTEM_PROMPT="$PUTIN_PROMPT" call_claude "$USER_MSG" >> /tmp/putin_resp_$$.txt ) & local putin_pid=$! ``` The same paths are later read and removed: ```bash # 读取响应（带默认值） local TRUMP_RESP=$(cat /tmp/trump_resp_$$.txt 2>/dev/null || echo "（未响应）") local NETANYAHU_RESP=$(cat /tmp/netanyahu_resp_$$.txt 2>/dev/null || echo "（未响应）") local PEZESHKIAN_RESP=$(cat /tmp/pezeshkian_resp_$$.txt 2>/dev/null || echo "（未响应）") local VANCE_RESP=$(cat /tmp/vance_resp_$$.txt 2>/dev/null || echo "（未响应）") local PUTIN_RESP=$(cat /tmp/putin_resp_$$.txt 2>/dev/null || echo "（未响应）") # 清理临时文件 rm -f /tmp/*_resp_$$.txt ``` ### Technical Analysis The script constructs temporary filenames f ...[truncated 2613 chars]
Remediation
View remediation
&2 exit 1 } cleanup() { local exit_code=$? trap - EXIT INT TERM rm -rf -- "$TMP_DIR" exit "$exit_code" } trap cleanup EXIT INT TERM HISTORY_FILE="$TMP_DIR/debate_history.txt" TRUMP_RESPONSE_FILE="$TMP_DIR/trump_response.txt" NETANYAHU_RESPONSE_FILE="$TMP_DIR/netanyahu_response.txt" PEZESHKIAN_RESPONSE_FILE="$TMP_DIR/pezeshkian_response.txt" VANCE_RESPONSE_FILE="$TMP_DIR/vance_response.txt" PUTIN_RESPONSE_FILE="$TMP_DIR/putin_response.txt" : > "$HISTORY_FILE" ``` Additional hardening measures: 1. Replace every direct `/tmp/...$$...` reference with a quoted path inside `$TMP_DIR`. 2. Avoid wildcard cleanup in a shared directory. 3. Set `umask 077` before creating files containing prompts or model responses. 4. Quote every file path and use `--` for commands that support end-of-options markers. 5. Validate that `TMP_DIR` is non-empty and has the expected prefix before recursive deletion. 6. Consider checking directory ownership and permissions after creation. 7. Use fixed file descriptors or securely created files if temporary files must be accessed concurrently. 8. Add concurrent-run and pre-created-symlink tests to the shell-script security test suite. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (83)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
94% confidence
Finding

The skill architecture depends on an external model CLI/provider selection and sends assembled prompts to that external service. In context, this is more dangerous because the prompts are built from local files and user discussion topics, so sensitive local content may leave the environment without a prominent trust boundary or provider-handling disclosure.

Content

Scanner excerpt · README.md (reported line 138)May include surrounding context.

wait

5. 主持人顺序总结

claude --print --system-prompt "$STARMER_PROMPT"

text

### 依赖要求

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch is more serious because the finding states the skill reads multiple local SKILL.md files as role background and may focus on hardcoded geopolitical topics, while that local resource access is not fully reflected in the declared purpose. Undisclosed file reads combined with external transmission materially increase privacy and supply-chain risk, since local skill content may contain proprietary prompts, internal workflows, or sensitive contextual data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

This mismatch is more serious because the finding states the skill reads multiple local SKILL.md files as role background and may focus on hardcoded geopolitical topics, while that local resource access is not fully reflected in the declared purpose. Undisclosed file reads combined with external transmission materially increase privacy and supply-chain risk, since local skill content may contain proprietary prompts, internal workflows, or sensitive contextual data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch is more serious because the finding states the skill reads multiple local SKILL.md files as role background and may focus on hardcoded geopolitical topics, while that local resource access is not fully reflected in the declared purpose. Undisclosed file reads combined with external transmission materially increase privacy and supply-chain risk, since local skill content may contain proprietary prompts, internal workflows, or sensitive contextual data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

This mismatch is more serious because the finding states the skill reads multiple local SKILL.md files as role background and may focus on hardcoded geopolitical topics, while that local resource access is not fully reflected in the declared purpose. Undisclosed file reads combined with external transmission materially increase privacy and supply-chain risk, since local skill content may contain proprietary prompts, internal workflows, or sensitive contextual data.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
1. **Skill内容外传**：脚本读取 `SKILL.md` 文件内容，通过 `claude --print` 发送到外部

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

The documentation explicitly instructs use of an external provider CLI (claude --print) to process debate content, including user-supplied input and system prompts, without discussing trust boundaries, provider selection controls, or the security/privacy implications of sending data off-box. In this skill, the danger is heightened because the architecture encourages multiple concurrent external calls, magnifying data exposure, cost, and policy/compliance risks.

Content

Scanner excerpt · v5/README.md (reported line 43)May include surrounding context.

wait

3. 主持人顺序总结

claude --print --system-prompt "$STARMER_PROMPT"

text

## 文件结构

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · v5/debate_parallel.sh (reported line 25)May include surrounding context.

sh
# 临时文件清理函数
cleanup() {
    local exit_code=$?
    rm -f /tmp/*_resp_$$.txt /tmp/debate_history_$$.txt 2>/dev/null
    exit $exit_code
}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · v5/debate_parallel.sh (reported line 160)May include surrounding context.

sh
# 临时文件清理函数
cleanup() {
    local exit_code=$?
    rm -f /tmp/*_resp_$$.txt /tmp/debate_history_$$.txt 2>/dev/null
    exit $exit_code
}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · v5/debate_parallel.sh (reported line 213)May include surrounding context.

sh
# 临时文件清理函数
cleanup() {
    local exit_code=$?
    rm -f /tmp/*_resp_$$.txt /tmp/debate_history_$$.txt 2>/dev/null
    exit $exit_code
}

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code explicitly recommends '利用认知偏差' and using loss framing to strengthen persuasion, which is direct advice to exploit cognitive vulnerabilities. That is materially more dangerous than ordinary rhetoric support because it encourages tailored psychological manipulation and could be applied to deceive, pressure, or unduly influence users in sensitive discussions.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly promotes use of external shell/CLI execution to implement the skill, including direct invocation of a debate script and later exec(...) usage. For a forum/debate skill, this expands capability well beyond content generation into host command execution, which creates unnecessary attack surface if user-controlled topic text, paths, or future script changes influence commands or subprocess behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README describes sending user topic text and contents of local skill files into multiple parallel claude processes, but does not clearly disclose the privacy and data-sharing implications of forwarding that material to external model services. This can multiply exposure because the same sensitive data may be replicated across several subprocesses and remote provider interactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented workflow reads full local skill files from the user's home/workspace and injects their contents into prompts for external model processes. That gives the skill local file access unrelated to merely hosting a discussion and risks exposing proprietary prompts, secrets, or sensitive local context if those skill files contain confidential material.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
88% confidence
Finding

The example path reveals and depends on enumerating specific local skill directories under the user's home/workspace. While not severe alone, this discloses local structure and encourages harvesting prompt files for multiple personas, which can aid unauthorized prompt extraction or broaden data exposure if the skill runs in a more privileged environment.

Content

Scanner excerpt · README.md (reported line 122)May include surrounding context.

bash
# 1. 读取所有参与者的Skill文件
TRUMP_SKILL=$(cat ~/.openclaw/skills/donald-trump-perspective/SKILL.md)

# 2. 构建系统提示
TRUMP_PROMPT="你是特朗普。背景：$TRUMP_SKILL ..."

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documentation explicitly states that v5.0 reads local SKILL.md files, uses environment variables such as SKILLS_DIR and OUTPUT_DIR, and sends content to an external API, yet the manifest declares no allowed-tools or permission scope. This creates an under-specified trust boundary: consumers may invoke a skill that performs filesystem/environment access and data egress without an explicit least-privilege declaration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are very broad and overlap with normal conversational language such as '讨论', '辩论', or '圆桌会议', which can cause accidental activation in unrelated contexts. Overbroad activation is dangerous here because the skill is documented as reading local skill files and sending content externally, so an unintended trigger could cause unexpected data processing or egress.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file presents the usage guide primarily in Chinese, with only a minimal English title, and does not state that users can choose another language. That can violate a language/locale policy when a skill imposes a specific language without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JavaScript file uses Chinese-only natural-language labels, comments, warnings, and thrown error messages such as 'participant 不能为空' and '未找到目标论点'. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation, and the file does not indicate any language selection or region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s natural-language documentation is primarily in Chinese, and the visible warning/output strings are also hard-coded in Chinese. Under the stated policy, forcing a specific language without user opt-in is a locale-policy issue unless the regional constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The header presents this as the '核心讨论引擎' and notes fixes such as removing hardcoded paths and refactoring, while the runForum docstring says the simulation mode implementation was completed. In context of the skill's declared purpose and version claims, the code behavior is still only a simplistic simulation with generated template speeches, which contradicts the apparent intent of being the real core debate engine.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a substantive multi-agent debate capability with parallel execution and game-theoretic analysis modules. In this file, runForum is explicitly a simulation mode that generates canned text and random scores, with no Claude Code CLI integration, no real agent execution, and no analysis logic for signaling, bargaining, coalition, or behavioral economics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The report formatter hard-codes toLocaleString('zh-CN'), which forces Chinese locale output for generated reports. This is a natural-language/locale policy issue because the file does not offer user opt-in or configuration for language/locale selection, nor does it document a region-specific justification.

Content

No source excerpt is available for this finding.