ClawHub
Back to skill

Security audit

blog-polish-en-astro-cn

Security checks for vulnerabilities and agentic risk

Overview

This blog-polishing skill mostly does what it says, but it uses unsafe shell evaluation on a user-controlled output directory before writing files.

Review before installing. Use only trusted draft paths and simple output directories, and do not pass untrusted or shell-like values such as command substitutions in `outputDir` until the publisher removes the `eval` path expansion. Expect the skill to create Markdown files and an images folder in the chosen output directory.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
80% confidence
Finding
The declared output schema does not match the actual returned object, which can break consumers that rely on schema validation and cause them to mis-handle or ignore output paths. In an agent ecosystem, schema drift can create unsafe orchestration behavior, such as downstream steps reading the wrong file or skipping validation on unexpected outputs.

Vague Triggers

Medium
Confidence
74% confidence
Finding
Overly broad trigger phrases can cause the skill to activate on ordinary writing requests without clear user intent. In this skill, activation leads to reading from a default local draft path and writing files/directories on disk, so accidental invocation can cause unintended local file processing and side effects.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill description omits that it writes files and creates directories, which undermines informed user consent for filesystem side effects. In an agent context, hidden write operations are security-relevant because users may believe the action is purely generative while the skill modifies local storage.

Static analysis

No suspicious patterns detected.