ClawHub
Back to skill

Security audit

证券监管监控

Security checks for vulnerabilities and agentic risk

Overview

This skill is a securities-page monitoring helper, but it relies on recurring root-path scripts outside the reviewed package and includes under-scoped WeCom notification instructions.

Install only if you already trust and manage the /root/monitoring/securities deployment. Confirm the cron entry, script ownership, permissions, and cleanup policy; run it under a least-privileged account if possible; and verify the WeCom recipient before any notification is sent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/run_monitor.sh:9
Finding

Execution of Unverified External Monitoring Scripts

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/api.md:53
Finding

Hard-Coded WeCom Recipient Can Misdirect Monitoring Notifications

Content
View full analysis
Remediation
View remediation
` in documentation so examples cannot be copied as functional fixed routing instructions. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs use of privileged and system-wide storage locations such as /root, /var/log, and /tmp for automated monitoring outputs, but does not clearly warn the user that running the workflow writes files to disk and persists potentially sensitive monitoring data. This can cause unanticipated data retention, exposure to other local users or processes, and operation with unnecessary privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill states that the system is already configured to run daily via cron, indicating persistent scheduled execution beyond the current session. Persistence itself is not inherently malicious here, but it is security-relevant because it creates ongoing automated activity and recurring access to network, filesystem, and logs without emphasizing consent or lifecycle controls.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

系统已配置每天早上9:00自动运行：

bash
# 查看当前定时任务
crontab -l

# 输出示例：
# 0 9 * * * /root/monitoring/securities/scripts/crawl_all.sh >> /var/log/securities/cron.log 2>&1

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill offers to send detected updates through Enterprise WeChat without clearly warning that monitored page content and change summaries may be transmitted to an external messaging platform. Even if the monitored pages are public, notifications may contain aggregated or contextualized information that users do not expect to leave the local environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md
如遇问题，请检查：
1. 执行日志：`/var/log/securities/cron.log`
2. 定时任务：`crontab -l`
3. 通知文件：`ls -la /tmp/securities_*.txt`

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file instructs the agent/user to send messages through the message tool to the wecom channel, which transmits content to an external system. The description provides usage details and recipient examples but does not include any warning about privacy, recipient verification, or disclosure that message contents will leave the local environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

修改定时任务

bash
# 编辑crontab
crontab -e

# 常用时间表达式示例：
# 每6小时执行一次

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 33)May include surrounding context.

修改定时任务

bash
# 编辑crontab
crontab -e

# 常用时间表达式示例：
# 每6小时执行一次

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file includes irreversible deletion commands using rm -rf and find ... -delete, but provides no user-facing warning about the risk of accidental data loss if paths or patterns are misconfigured. For markdown files, destructive behaviors that can affect user data or system integrity should be explicitly disclosed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script's comments and all user-visible messages are fixed in Chinese, which can violate language/locale policy when no user opt-in or alternative locale is offered. There is no indication that the skill is region-specific or intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

All user-facing instructions in this file are presented exclusively in Chinese, and the document does not indicate that the skill is region-specific or that users can choose another language. This may violate a language/locale policy if skills are expected not to force a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The markdown file states that the skill supports 企业微信 notifications, which implies sending monitoring content to a third-party communication platform. The README does not disclose any privacy or data-handling implications of transmitting page-change information through that channel.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill documentation is entirely in Chinese and does not offer an alternative language or indicate that the locale is intentionally restricted to a Chinese-speaking environment. This can violate language/locale policy when a specific language is forced without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's comments and console messages are entirely in Chinese, which imposes a specific language on users without offering an alternative or opt-in. This can violate language or locale policy where skills are expected to remain language-neutral unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This code changes into /root/monitoring/securities/scripts and executes another shell script, which is a safety-relevant operation in a privileged-looking location. Although the script prints status messages, it does not disclose that it will run another script from a root path or warn about any privilege or system-impact expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This shell script executes bash crawl_all.sh, which is a subprocess operation covered by the missing-warning rule for code files. Although there is a progress message, the script does not disclose what the crawler may do to user/system data, such as network access or potential file writes, and the visible comments are only operational labels rather than a safety warning.

Content

No source excerpt is available for this finding.