ClawHub
Back to skill

Security audit

AI 文本语气精修

Security checks for vulnerabilities and agentic risk

Overview

This skill edits Chinese prose and optionally checks selected local documents, with no material security concerns found.

Choose the documents or folders to audit deliberately; recursive scanning requires an explicit option. Audit output includes text excerpts. Review proposed edits, and remember that pattern results do not establish authorship or guarantee any AI-detector outcome.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (16)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
### Contrast Check

Before touching a `不是 A，而是 B` sentence, look for A in four places: earlier text and the title, the user's request, an explicit reader question, and a saying the text attributes to someone. Do not judge by whether A sounds concrete or abstract, or by quotation marks around A: a quoted phrase with no stated source is still an invented target. A definitional question does not create a source either: in `何谓 X？不是 A，而是 B`, A counts only if someone in the text or the request actually reads X that way.

| Source | Decision |
|---|---|

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 139)May include surrounding context.

python
def test_cli_expands_windows_style_glob(self):
        # Glob expansion only. Fidelity tests check after-fixture verdicts.
        pattern = str(SKILL_ROOT / "tests" / "fixtures" / "*_after.md")
        completed = subprocess.run(
            [sys.executable, str(SCRIPT_PATH), pattern],
            check=False,
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 151)May include surrounding context.

python
self.assertNotIn("Traceback", completed.stderr)

    def test_cli_accepts_stdin_and_emits_versioned_json(self):
        completed = subprocess.run(
            [sys.executable, str(SCRIPT_PATH), "--stdin", "--json", "--profile", "general"],
            input="普通句子。",
            check=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 167)May include surrounding context.

python
self.assertIn("authorship", payload["verdict_semantics"].lower())

    def test_cli_plain_output_explains_clear_verdict(self):
        completed = subprocess.run(
            [sys.executable, str(SCRIPT_PATH), "--stdin"],
            input="普通句子。",
            check=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 181)May include surrounding context.

python
def test_cli_reports_missing_path_without_traceback(self):
        with tempfile.TemporaryDirectory() as temp_dir:
            missing = str(Path(temp_dir) / "missing.md")
            completed = subprocess.run(
                [sys.executable, str(SCRIPT_PATH), missing],
                check=False,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 193)May include surrounding context.

python
self.assertNotIn("Traceback", completed.stderr)

    def test_cli_fail_on_review_exits_1_when_document_needs_review(self):
        completed = subprocess.run(
            [sys.executable, str(SCRIPT_PATH), "--stdin", "--fail-on-review"],
            input="总的来说，范围已经收束。值得注意的是，步骤没有变。",
            check=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 206)May include surrounding context.

python
self.assertNotIn("Traceback", completed.stderr)

    def test_cli_fail_on_review_exits_0_for_zero_severity_contrast(self):
        completed = subprocess.run(
            [sys.executable, str(SCRIPT_PATH), "--stdin", "--fail-on-review"],
            input="这不是效率问题，而是系统问题。",
            check=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 462)May include surrounding context.

python
nested = root / "nested"
            nested.mkdir()
            (nested / "note.md").write_text("普通句子。", encoding="utf-8")
            completed = subprocess.run(
                [sys.executable, str(SCRIPT_PATH), str(root)],
                check=False,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 481)May include surrounding context.

python
(root / "top.txt").write_text("普通句子。", encoding="utf-8")
            (nested / "note.md").write_text("这也是普通句子。", encoding="utf-8")
            (nested / "skip.py").write_text("print('先备份，再部署')", encoding="utf-8")
            without = subprocess.run(
                [sys.executable, str(SCRIPT_PATH), str(root), "--json"],
                check=False,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 488)May include surrounding context.

python
text=True,
                encoding="utf-8",
            )
            with_flag = subprocess.run(
                [sys.executable, str(SCRIPT_PATH), str(root), "--recursive", "--json"],
                check=False,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 881)May include surrounding context.

python
encoding="utf-8",
            )
            missing = root / "missing.txt"
            kept = subprocess.run(
                [
                    sys.executable,
                    str(SCRIPT_PATH),

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 897)May include surrounding context.

python
text=True,
                encoding="utf-8",
            )
            plain = subprocess.run(
                [sys.executable, str(SCRIPT_PATH), str(draft), "--json", "--profile", "general"],
                check=False,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_audit_ai_flavor.py (reported line 904)May include surrounding context.

python
text=True,
                encoding="utf-8",
            )
            absent = subprocess.run(
                [
                    sys.executable,
                    str(SCRIPT_PATH),

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 594)May include surrounding context.

text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 606)May include surrounding context.

text
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_audit_ai_flavor.py:22

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_fixture_fidelity.py:165