ClawHub
Back to skill

Security audit

中国邮政储蓄银行官网

Security checks for vulnerabilities and agentic risk

Overview

The skill is only a banking link list and contains no executable behavior, but its official-site trust claims and several URL mappings are under-verified enough to warrant review before use.

Review this skill carefully before installing. It does not run code or access your system, but it may cause an agent to present sensitive banking, wealth-management, recruitment, or login destinations as fully official without enough verification. Users should independently confirm any returned link through PSBC-controlled sources before signing in or submitting personal or financial information.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Warning
Location
SKILL.md:4
Finding

Unqualified Trust Claim for a Third-Party Recruitment Domain

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4–28
Vulnerability Type: other: Misleading External Trust
Risk Level: Medium

Vulnerable Content

The following is an English rendering of the relevant audited content:

yaml
description:
  Collects all China Postal Savings Bank official websites from the Internet.
  They are all official websites and completely trustworthy.
text
PSBC Head Office recruitment application system:
https://psbc2026.zhaopin.com/
A common recruitment portal for the head office and some branches.

Technical Analysis

The Skill makes an unconditional claim that every listed destination is an official and completely trustworthy PSBC website. However, the recruitment destination uses the registrable domain zhaopin.com, rather than a PSBC-controlled domain such as psbc.com.

A bank may legitimately use an external recruitment provider, but that does not make the provider's domain an official bank-owned website or justify an unconditional trust assertion. The Skill does not identify the destination as a third-party service, provide evidence that PSBC authorizes it, or instruct the Agent to verify it against a bank-published source.

This is not code execution, privilege escalation, or instruction hijacking. It is unsafe trust guidance that can cause an Agent to represent an external service as a fully trusted official banking website.

Attack Path

  1. A user asks the Agent for the official PSBC recruitment application website.
  2. The Skill is selected because it claims to contain fully trusted official PSBC destinations.
  3. The Agent returns https://psbc2026.zhaopin.com/ and may repeat or imply the Skill's official-site assurance.
  4. The user follows the external link while believing that PSBC directly owns and operates it.
  5. The user may submit identity, contact, education, employment, or recruitment-related information without recogniz ...[truncated 861 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove claims that every listed website is “completely trustworthy.”
  2. Clearly distinguish bank-owned domains from authorized third-party service providers.
  3. Describe zhaopin.com as an external recruitment platform rather than an official bank-owned domain.
  4. Verify the recruitment URL against a current link published on a PSBC-controlled website before including it.
  5. Record the verification source and date because campaign-specific recruitment subdomains may expire or change.
  6. Instruct the Agent to tell users to confirm the destination through PSBC's primary website before submitting personal information.
  7. Avoid treating TLS alone as proof of bank ownership; validate the registrable domain, legal operator, and official cross-linking.

other

Warning
Location
SKILL.md:20
Finding

Conflicting Legal-Entity Attribution for the Same Financial Domain

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–29
Vulnerability Type: other: Misleading Domain Attribution
Risk Level: Medium

Vulnerable Content

The following is an English rendering of the relevant audited content:

text
China Post Wealth Management Co., Ltd. official website:
https://www.psbc-wm.com/
Official website of PSBC's wealth-management subsidiary.
text
China Post Youhui Wanjia Bank Co., Ltd.:
https://www.psbc-wm.com/
PSBC's independently incorporated direct bank.

Technical Analysis

The same URL, https://www.psbc-wm.com/, is attributed to two different legal entities:

  • China Post Wealth Management Co., Ltd.
  • China Post Youhui Wanjia Bank Co., Ltd.

These descriptions cannot both be reliable mappings of the same domain to distinct official entities without additional explanation. At least one record is inaccurate, incomplete, or misleading.

Financial-service domain attribution is security-sensitive because users rely on the stated legal operator when deciding whether to browse products, authenticate, or disclose financial and personal information. The Skill contains no ownership-validation mechanism and directs the Agent to obtain and output the listed URL without resolving the contradiction.

Attack Path

  1. A user asks for the official website of either listed legal entity.
  2. The Agent consults the Skill and finds https://www.psbc-wm.com/ assigned to that entity.
  3. The Agent returns the URL as the requested entity's official website.
  4. The user relies on the incorrect legal-entity attribution.
  5. The user may browse products, follow authentication links, or disclose information under a mistaken understanding of which company operates the service.

No attacker-controlled execution is demonstrated. The exploitability arises from inaccurate trust metadata and the Agent's ability to present that metadata authoritatively.

Imp

...[truncated 597 chars]

Remediation
View remediation

Remediation Suggestions

  1. Verify the registrant and legal operator of psbc-wm.com using authoritative company and bank-controlled sources.
  2. Retain only the validated entity-to-domain mapping.
  3. Locate and separately verify the official website of the other legal entity.
  4. Add structured fields for the legal entity, registrable domain, service type, ownership status, verification source, and verification date.
  5. Reject duplicate domain mappings when they claim conflicting legal ownership unless the relationship is explicitly documented.
  6. Require manual review for financial domains whose ownership metadata is ambiguous.
  7. Avoid telling users that a destination is official until its legal attribution has been independently confirmed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The empty 'When to Run' section leaves invocation scope undefined, so the skill may be triggered in situations where the user did not explicitly ask for official PSBC websites. For a banking-link skill, overbroad activation increases the chance of unsolicited link delivery, context confusion, and mistaken reliance on banking URLs during unrelated interactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Natural-language policy review applies to all file types. Presenting the skill description exclusively in one language without noting locale constraints or offering language choice can be a language policy issue if users are not explicitly opted into Chinese.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The output example labels the result as the Chinese official website but provides the main-site URL instead. In a banking context, incorrect URL mapping can misdirect users to the wrong service, create confusion about authoritative destinations, and weaken trust in the skill’s output when users rely on exact links for sensitive tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.