Security audit

TRIZ Systematic Innovation Method

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a TRIZ analysis tool, but its install instructions and report claims need Review before users rely on it.

Review before installing. Prefer a pinned or verified installer instead of the documented `@latest` command, treat generated rankings as unvalidated brainstorming rather than engineering proof, and avoid entering sensitive business or technical details unless you are comfortable with a local markdown report being saved.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:124
Finding: Unpinned Mutable Package Execution in Installation Documentation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: triz.js:298
Finding: Random Scores Are Misrepresented as Validated Engineering Assessments
Content: View full analysis
({ id: i + 1, title: `Innovation Solution ${i + 1}`, description: `Detailed description of solution ${i + 1}`, trizPrinciples: ["Applicable TRIZ principle"], feasibility: Math.random(), impact: Math.random(), cost: Math.random(), timeToImplement: Math.random(), technicalValidation: "Pending validation" })); } evaluateSolution(solution) { // Evaluate 8 elements as specified return { ...solution, evaluation: { technicalFeasibility: Math.random(), businessImpact: Math.random(), implementationCost: Math.random(), timeToMarket: Math.random(), riskLevel: Math.random(), scalability: Math.random(), userAcceptance: Math.random(), technicalValidation: "Validated" // This would be actual validation } }; } ``` ### Technical Analysis The implementation uses `Math.random()` for feasibility, impact, cost, time, risk, scalability, and user-acceptance assessments. These values are not derived from the supplied problem statement, technical evidence, constraints, or a documented evaluation model. Despite this, `evaluateSolution()` labels every result as `"Validated"`. The documentation also presents the skill as generating validated solutions with comprehensive evaluation. The generated ranking therefore appears authoritative while being based on arbitrary values. This issue does not provide operating-system privileges or code execution. It is an output-integrity flaw that can cause users or downstream automation to treat fabricated assessments as engineering validation. ### Attack Path 1. A user submits an engin ...[truncated 1420 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx clawhub@latest install triz, which fetches and executes the latest published package version at install time rather than a reviewed, pinned version. If the upstream package is compromised, typo-squatted, or publishes a malicious update, users could execute attacker-controlled code simply by following the documentation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation bullets include broad contexts such as 'engineering or product development discussions involving technical challenges' and 'requests for innovation methodology or problem-solving frameworks,' which can overlap with many ordinary conversations. The file does not provide constraints or negative examples clarifying when the skill should not activate, increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User-facing natural-language fields, including the bridge name, description, and analysis steps, are entirely specified in Chinese, with no indication that users can choose another language or that the skill is intended only for a Chinese-language environment. This creates a locale/language policy concern because the skill appears to impose a specific language without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The execution condition problem_attributes.general == true is broad and underspecified, so the skill may activate for many loosely classified inputs rather than only for narrowly intended use cases. In an agent system, overly broad routing can cause inappropriate invocation, unexpected behavior, or interference with more suitable skills, especially since this skill drives a specific multi-step analysis workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code and user-facing output present solutions as 'validated' or imply technical validation even though the implementation uses placeholder logic and random scoring rather than real verification. In a decision-support skill, this can mislead users into trusting unverified engineering recommendations, which may cause poor technical, operational, or safety decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The tool writes a full analysis report to disk automatically without notifying the user or obtaining consent. Because the report may include sensitive problem statements, business context, or proprietary engineering data, this behavior can create unintended local data persistence and confidentiality exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx clawhub@latest install triz, which fetches and executes the latest published package version at install time. Because the version is not pinned, a compromised publisher account, malicious upstream release, or breaking change could cause arbitrary code execution on the user's machine when they follow the documented installation step.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation criteria are broad enough to match many ordinary engineering or product-development conversations, not just explicit requests to use TRIZ. That can cause the skill to trigger unexpectedly, injecting a specific methodology into unrelated contexts and potentially steering user workflows without clear intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language metadata and step names are entirely in Chinese, with no indication that language is selectable or that the skill is intended only for a Chinese-language environment. This can violate language/locale policy when users have not opted into that locale.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The execution condition problem_attributes.general == true is broad and lacks additional gating, so this skill may activate for a wide range of loosely classified problems. In an agent system, overly broad triggering can cause inappropriate skill selection, unintended workflow influence, and increased exposure to any downstream prompt or logic issues embedded in the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level documentation claims the tool generates 'validated innovative solutions', but the implementation later assigns scores with Math.random() and labels validation as pending or validated without performing any real verification. This can mislead users into trusting fabricated analysis results, creating an integrity issue that is especially risky in engineering or product decision-making contexts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code explicitly sets technicalValidation to 'Validated' in evaluateSolution() even though no validation is performed and the surrounding metrics are randomly generated. This is dangerous because downstream users or systems may treat these outputs as authoritative and make product, safety, or investment decisions based on fabricated assurance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The tool writes the full report, including the original problem statement and generated analysis, to a local markdown file by default without consent, warning, redaction, or configurable storage controls. If users include proprietary, personal, or otherwise sensitive information in problem statements, this behavior can create unintended data retention and exposure on shared systems or developer workstations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This JSON skill content presents all user-facing natural-language fields exclusively in Chinese, including project descriptions, problem statements, and report sections. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not shown here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON template contains multiple user-facing strings in Chinese, including component names, analysis steps, parameters, and principle names, while the surrounding metadata is in English. Under the policy rule for language/locale, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON example uses Chinese-language titles, descriptions, and report sections throughout, but provides no indication that the language is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON template contains user-facing component names, steps, parameters, and principles largely in Chinese, while the file provides no indication that the skill is intentionally region-specific or that users can opt into this locale. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.