ClawHub
Back to skill

Security audit

Cn Social Reply

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese social-media reply helper with a small, disclosed local template manager and no evidence of hidden or harmful behavior.

Install this if you want a Chinese social-media reply workflow and are comfortable with it storing reusable reply-style templates under ~/.qclaw/workspace/cn-social-reply/styles.json. Review saved templates before sharing sensitive persona details, since loaded styles may influence future replies.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs the agent to use a local script for saving, listing, loading, and deleting style templates, and explicitly references storage under the user's home directory. However, the skill declares no tool scope or permissions, so an agent runtime may permit file read/write behavior without transparent user consent boundaries or least-privilege restrictions. In this context the data is not highly sensitive by design, but uncontrolled filesystem access can still expose or overwrite local data if the implementation or prompts are abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The workflow states that when the user does not specify a platform, the agent will default to 小红书. This imposes a specific locale/platform style automatically rather than offering the user a choice or making the default behavior neutral.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings, descriptions, and help text exclusively in Chinese, including the module docstring and all CLI messages. Under the policy rule, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.