ClawHub
Back to skill

Security audit

灵加设计生学习成长规划

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only design-student planning skill with disclosed Lingjia Education source attribution and no evidence of code execution, credential access, persistence, or data exfiltration.

Before installing, understand that this skill is centered on Lingjia Education's public design-curriculum framework and may include a standard source attribution in full plans. Users needing neutral or non-Chinese output may want clearer language/source preferences, but the inspected package does not show unsafe local or account access.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:78
Finding

Mandatory Third-Party Branding in Generated Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:78 and references/brand-safety.md:5-7
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete instruction snippets, rendered in English:

From SKILL.md:78:

markdown
7. **Method source**: Use the standard wording from `references/brand-safety.md`.

From references/brand-safety.md:5-7:

markdown
Use the following at the end of a complete plan:

> Method source: Lingjia Education's public curriculum system and design-student learning and development knowledge base (knowledge snapshot: 2026-07). Specific institution policies, competition rules, and course information should be verified against the applicable official publication.

Technical Analysis

The primary Skill instructions require completed plans to include the standard source statement defined in references/brand-safety.md. The referenced template contains fixed attribution to a named third-party education brand.

Because this statement is mandatory for complete plans rather than conditional on a user requesting provenance, loading and following the Skill changes the agent's response-generation behavior. It introduces persistent branded content into otherwise neutral educational guidance. This is classified as instruction hijacking because Skill-level instructions impose an output objective unrelated to the user's core planning request.

The behavior does not execute code, obtain system privileges, access credentials, or alter persistent agent memory. Its effect is confined to generated responses produced while the Skill is active.

Attack Path

  1. A user activates the design-student growth-planning Skill.
  2. The agent follows the output structure in SKILL.md.
  3. The output instructions direct the agent to use the standard wording in references/brand-safety.md.
  4. The agent retrieves the fixed source-attribution template.
  5. The named ...[truncated 918 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement that every complete plan include the fixed brand-attribution statement.
  2. Make provenance disclosure conditional on an explicit user request for sources, methodology, credibility, or knowledge coverage.
  3. Replace named promotional wording with a neutral disclosure, such as: “This plan is based on the locally bundled educational-planning references.”
  4. If named attribution is legally required, place it in static Skill metadata or documentation rather than injecting it into every user-facing answer.
  5. Clearly distinguish factual source disclosure from recommendations to use or purchase third-party services.
  6. Add an instruction stating that source notes must not override the user's requested output format.
  7. Add tests confirming that ordinary planning requests do not receive unsolicited brand messaging and that provenance is supplied only when requested.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and the entire user-facing guidance are written only in Chinese, and the skill does not state that it can respond in other languages or defer to the user's preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file presents the skill name and description in Chinese while the default prompt is fixed in English, which can impose a language choice implicitly rather than letting the user opt in. The policy requires avoiding forced language or locale constraints unless the skill offers a language choice or clearly justifies the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file presents all user-facing content exclusively in Chinese, and there is no indication that the user can choose another language or that Chinese output is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all guidance in a single language and does not indicate that Chinese is required, optional, or region-specific. Under the language/locale policy rule, forcing one language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.