ClawHub
Back to skill

Security audit

Skill Recommender

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent local skill-matching helper; it is narrower and Chinese-oriented, but it does not show hidden access, persistence, network use, or destructive behavior.

Install only if you are comfortable with a local Node.js helper reading SKILL.md files from the skills directory you provide. Expect lightweight keyword-based recommendations rather than a comprehensive runtime-neutral recommender, and be aware that several templates and examples are written in Chinese.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description presents a recommendation engine that matches skills to user needs and provides higher-level analysis such as rationale, duplicate detection, and gap analysis. The supplied code instead performs simple clustering of existing local skills by regex-based categories after scanning a skills directory. Its primary purpose is categorization/grouping, not recommendation. It also relies on a Node.js script and local directory access, which conflicts with the claim of being runtime-neutral. There is no evidence of handling user-need input beyond an optional skills_dir parameter, and none of the declared outputs are implemented.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The code does implement a basic skill recommendation function and provides a simple rationale ('why' via matched terms), so it partially matches the declared purpose. However, the description promises broader, runtime-neutral recommendation behavior, including handling an existing skill list as input, suggesting duplicate/merge candidates, and finding gaps for new skill briefs. The actual code is narrower: it is a Node.js script that reads local SKILL.md files from a filesystem directory, ranks them by lexical matching, and returns recommendations only. Those missing and platform-specific behaviors are material enough to constitute a description/behavior mismatch.

Ae1

High
Category
analysis-evasion
Content
Use `scripts/recommend_skills.js` when the user gives a query such as:
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
Use `scripts/recommend_skills.js` when the user gives a query such as:
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
Use `scripts/cluster_skills.js` when the user wants a grouped view of similar skills, duplicates, or overlapping categories.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
Use `scripts/check_skill_dedup.js` when the user is about to build a new skill and wants to know:
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The skill's concrete invocation examples and output contract are entirely in Chinese, and the document does not state that users may interact in other languages or choose their preferred locale. This creates a language policy concern because the skill implicitly requires or strongly biases one language without explicit opt-in or justification.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The file hard-codes a Chinese-only response pattern ('用户要做什么', etc.) without any indication that the user's locale, preferences, or system policy require Chinese output. This can override user expectations, degrade usability, and cause downstream misinterpretation in multilingual workflows, especially in tooling that assumes responses follow the user's requested language.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The example `query` value at L19 is written in Chinese, which can imply a fixed language expectation in the skill's interface or examples. Because the file does not state that the schema is language-agnostic or that users may supply queries in their preferred language, this may conflict with language/locale choice expectations.

Static analysis

No suspicious patterns detected.