ClawHub
Back to skill

Security audit

Agentizer-zh — 镜像版 Humanizer-zh，AI 味精生成器

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese satire/style skill, but it asks for file-writing authority that its text-rewrite purpose does not justify.

Install only if you want a Chinese-language parody style mode. Review the tool permissions first: Read/Grep/Glob are understandable for packaged references, but Write/Edit should be removed or tightly scoped unless you explicitly want the skill to save generated output to files.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:12
Finding

Excessive Workspace Modification Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–18
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools:
  - Read
  - Write
  - Edit
  - Grep
  - Glob
  - AskUserQuestion

Technical Analysis

The Skill's documented purpose is to transform user-provided text into an exaggerated AI writing style. Its workflow requires reading the packaged reference material and generating a response, but it does not document any legitimate need to modify project or workspace files.

Nevertheless, the allowed-tools configuration grants both Write and Edit. These tools expand the Skill's authority from read-only text processing to filesystem modification. This violates the principle of least privilege and increases the consequences of instruction confusion, adversarial user input, or future malicious changes to the Skill's instructions.

No reviewed instruction currently directs the agent to exercise these modification capabilities. The finding concerns unnecessary permission exposure rather than confirmed file tampering.

Attack Path

  1. The agent loads the Skill and receives the tools declared in allowed-tools.
  2. The Skill consequently has access to Write and Edit, despite its text-transformation purpose.
  3. An adversarial prompt, misinterpreted request, or later compromised instruction convinces the agent to treat workspace content as transformation output or otherwise requests a file change.
  4. The agent invokes Write or Edit under the Skill's existing authority.
  5. Source files, configuration, documentation, or other accessible workspace content may be altered without that capability being necessary for the Skill's intended function.

Impact Assessment

Successful exploitation could permit modification or replacement of files available within the agent's workspace authorization boundary. Potential effects include source-code corruption, c ...[truncated 388 chars]

Remediation
View remediation

Remediation Suggestions

Apply least privilege by removing filesystem modification tools from the Skill:

yaml
allowed-tools:
  - Read

Additional hardening measures:

  1. Retain Grep and Glob only if reference discovery cannot be handled through fixed, read-only paths.
  2. Retain AskUserQuestion only if interactive clarification is part of a documented workflow.
  3. Enforce a read-only filesystem sandbox when this Skill is active.
  4. If a future feature legitimately requires generated text to be saved, request write access only for that explicit operation and restrict it to a dedicated output directory.
  5. Add regression checks that reject changes introducing Write, Edit, shell execution, network access, or other expanded capabilities without documented justification and security review.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill name explicitly indicates a Chinese variant, and the document is entirely written as mandatory Chinese-language instructions without offering a language choice. This creates a locale/language constraint that is not presented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file hard-codes Chinese-only output behavior and an inflexible response style across all replies, with no user opt-in or language negotiation. This can override user intent, reduce accessibility for non-Chinese users, and cause the agent to ignore higher-level conversational context or user language preferences, making the skill unsafe from a policy/compliance and usability standpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该文档以中文标题和中文措辞规范开篇，并在 L005 明确要求“Agentizer-zh 激活时，每段至少注入 3 个”，属于对输出语言/表达风格的强制性要求。按照规则，若未提供用户选择或说明这是特定中文区域/中文技能专用，就构成语言或 locale 策略层面的自然语言违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file appears to require Chinese comprehension throughout, including the title, section headings, and all examples. The policy allows fixed-language content only when the skill offers user opt-in or clearly documents a justified locale restriction, neither of which is present here.

Content

No source excerpt is available for this finding.