Security audit

ChangeBrief

Security checks for vulnerabilities and agentic risk

Overview

ChangeBrief is a coherent snapshot-comparison skill with a local CLI; its main caveat is that it defaults user-facing output to Chinese.

Installers should expect a Chinese-first change-briefing CLI that reads the before/after text or files they provide and returns local analysis. Review whether the Chinese default and somewhat broad trigger wording fit your environment, but no hidden persistence, credential access, remote execution, or automatic publishing behavior was found.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for an analytical change-intelligence skill that compares knowledge snapshots and produces a change brief. The supplied code does none of that. Instead, it is a release/publishing automation script: it extracts version and changelog information, runs `npm ... run verify`, and invokes `clawhub publish`. This is a materially different primary purpose and includes undeclared external publishing behavior, so the description does not accurately represent the code.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user-facing change-analysis skill that compares knowledge snapshots and generates a structured change brief. The supplied code chunk does not implement that analysis behavior. Instead, it is a development/CI-style verification script for the project: it invokes local executables, runs tests, reads repository files, and asserts metadata/documentation correctness. While the smoke test references the expected change-brief output, this script’s primary purpose is verification, not performing the skill itself. That is a material description-behavior mismatch.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The primary skill description is written in Chinese and presents the skill identity and behavior in that language without any indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This markdown file contains user-facing natural-language content in Chinese for the short description, marketplace card copy, and install hook. Under the policy, forcing a specific language without user opt-in or clear region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The manifest description anchors use to a Chinese trigger phrase, and the document consistently presents prompts and output phrasing in Chinese. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only region or audience.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The 'When To Use It' section lists trigger-like user phrases such as '最近到底变了什么' and '告诉我哪些变化值得我现在处理' without defining boundaries for when this skill should not activate. Because these phrases can overlap with many ordinary requests about recent events or changes outside document/snapshot comparison, the trigger scope is ambiguous.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The default prompt explicitly instructs the skill to "answer in Chinese," which imposes a language choice without any visible user opt-in. This is a natural-language policy concern because it forces a specific locale behavior rather than offering or respecting user preference.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This code renders user-facing guidance, summaries, and action prompts entirely in Chinese, including decisions, headlines, and report sections. Because the skill forces a specific language in its natural-language output without offering a user language/locale choice or documenting a justified regional constraint, it violates the language/locale policy criterion.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The file mixes English and Chinese, and the 1.0.1 release theme and change bullets are presented only in Chinese. This can violate a language/locale policy when no user opt-in or documented justification is provided for forcing part of the skill documentation into a specific language.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The 1.0.0 release theme and change bullets are written only in Chinese, while the rest of the changelog is largely in English. Without an explicit bilingual policy, user opt-in, or documented regional scope, this is a natural-language locale policy concern.

Vague Triggers

Low

Confidence: 87% confidence
Finding: The manifest says to use "$changebrief" to compare snapshots, but it does not provide any scope limits, exclusion conditions, or negative examples clarifying when this skill should or should not be invoked. In a manifest file, this can make activation behavior ambiguous, especially if invocation depends on loosely defined snapshot-comparison requests.

Vague Triggers

Low

Confidence: 77% confidence
Finding: This manifest file provides a high-level description of the skill's capabilities but does not define when it should be invoked or what phrases should trigger it. Because manifest files are in scope for vague-trigger review, the lack of explicit trigger scope could contribute to unintended invocation in systems that infer activation from descriptions.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The file includes example statements only in Chinese, which can imply a language-specific expectation for use of the skill content. Because there is no accompanying note that the skill supports multiple languages or that Chinese is merely illustrative, this may conflict with a policy requiring language or locale choice rather than a forced language.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The natural-language string states '目前默认只支持英文模板', which imposes an English-only default. Under the policy, language or locale constraints should offer user choice or include clear justification; this text does neither.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/verify.js:12