ClawHub
Back to skill

Security audit

Ming

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese metaphysics entertainment skill using local calculators, with no observed network access, credential use, persistence, or destructive behavior.

Install only if you want a Chinese-language cultural/entertainment reference. Do not rely on it for medical, legal, financial, relationship, career, or other major decisions, and share birth dates or names only if you are comfortable with that local analysis. Expect simplified algorithms and possible accuracy limits.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code substantially matches part of the declared purpose: it performs simplified BaZi charting and Five Elements analysis, and also returns zodiac information. However, the declared description presents a broader tool including zodiac matching and Chinese name analysis, and the usage guidance also mentions lucky directions and auspicious dates. None of those capabilities appear in this code chunk. There is no evidence of unrelated or risky undeclared behavior such as network access, file access, or external resource use. The mismatch is therefore a description-to-behavior scope mismatch: the description overstates capabilities that this supplied code does not implement.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises no explicit tool restrictions while the file includes verification commands invoking Python and references to script files, indicating shell and file-read capabilities may be available or expected. In an agent environment, undeclared capability use weakens least-privilege boundaries and can let the skill access local files or execute commands beyond its stated metaphysics purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation scope is broad enough to capture sensitive requests about destiny, marriage, investment, health, and other major life decisions, increasing the chance the agent will provide culturally framed but unreliable advice in high-stakes contexts. Even though the file includes disclaimers later, broad triggers can still route inappropriate conversations into this skill before safer domain-specific handling occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The title and description present the skill entirely in Chinese and describe it as '你的中国传统命理参考工具' without stating that users may choose another language. This creates a language-policy concern because the skill appears to default to a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module title and description are entirely in Chinese and describe a Chinese-name analysis workflow, while the CLI usage and error messages are also Chinese-only. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module and function documentation state that the tool analyzes names using 五格剖象法, which requires correctly computing the five grids. However, the code computes 外格 as tiange + renge + dige - renge + 1, effectively tiange + dige + 1, while the adjacent comment says '总格 - 人格 + 1' and the separately computed zongge is not used. This is an active contradiction between the documented/intended formula and the implemented behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/verify.py (reported line 16)May include surrounding context.

python
def run_json(args):
    result = subprocess.run(
        [sys.executable, *args],
        cwd=ROOT,
        text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest sets the skill language to "zh", which indicates a fixed language/locale choice. Under the stated policy, a forced language setting is a violation unless the skill offers user choice or clearly documents and justifies the locale constraint; this file does not do so.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code file contains user-facing natural-language descriptions and later CLI usage/error messages exclusively in Chinese, indicating a fixed language choice. The policy for this category flags language or locale constraints when they are forced without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The usage example and error output shown to end users are fixed to Chinese, which can violate language/locale policy when no choice is offered. There is no visible configuration, flag, or documentation allowing users to select another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains user-facing descriptions, usage text, keys, and error messages exclusively in Chinese, which effectively forces a specific language/locale. The file does not offer an opt-in language choice or document that the skill is intentionally limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.