ClawHub
Back to skill

Security audit

Skill Recommender

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent local skill-matching helper; it is narrower and Chinese-oriented, but it does not show hidden access, persistence, network use, or destructive behavior.

Install only if you are comfortable with a local Node.js helper reading SKILL.md files from the skills directory you provide. Expect lightweight keyword-based recommendations rather than a comprehensive runtime-neutral recommender, and be aware that several templates and examples are written in Chinese.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a recommendation engine that matches skills to user needs and provides higher-level analysis such as rationale, duplicate detection, and gap analysis. The supplied code instead performs simple clustering of existing local skills by regex-based categories after scanning a skills directory. Its primary purpose is categorization/grouping, not recommendation. It also relies on a Node.js script and local directory access, which conflicts with the claim of being runtime-neutral. There is no evidence of handling user-need input beyond an optional skills_dir parameter, and none of the declared outputs are implemented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The code does implement a basic skill recommendation function and provides a simple rationale ('why' via matched terms), so it partially matches the declared purpose. However, the description promises broader, runtime-neutral recommendation behavior, including handling an existing skill list as input, suggesting duplicate/merge candidates, and finding gaps for new skill briefs. The actual code is narrower: it is a Node.js script that reads local SKILL.md files from a filesystem directory, ranks them by lexical matching, and returns recommendations only. Those missing and platform-specific behaviors are material enough to constitute a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
Use `scripts/recommend_skills.js` when the user gives a query such as:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
Use `scripts/recommend_skills.js` when the user gives a query such as:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
Use `scripts/cluster_skills.js` when the user wants a grouped view of similar skills, duplicates, or overlapping categories.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
Use `scripts/check_skill_dedup.js` when the user is about to build a new skill and wants to know:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill's concrete invocation examples and output contract are entirely in Chinese, and the document does not state that users may interact in other languages or choose their preferred locale. This creates a language policy concern because the skill implicitly requires or strongly biases one language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file hard-codes a Chinese-only response pattern ('用户要做什么', etc.) without any indication that the user's locale, preferences, or system policy require Chinese output. This can override user expectations, degrade usability, and cause downstream misinterpretation in multilingual workflows, especially in tooling that assumes responses follow the user's requested language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The example query value at L19 is written in Chinese, which can imply a fixed language expectation in the skill's interface or examples. Because the file does not state that the schema is language-agnostic or that users may supply queries in their preferred language, this may conflict with language/locale choice expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.