ClawHub
Back to skill

Security audit

Smart Refinement System

Security checks for vulnerabilities and agentic risk

Overview

This is a local prompt-refinement and skill-matching helper; the main cautions are unpinned installation instructions and broad tool recommendations that should stay user-confirmed.

Install only from a trusted or pinned ClawHub/npm source, do not run the npx installer with elevated privileges, and keep file writes, web access, and system-operation recommendations behind normal user confirmation. Avoid passing secrets in context or exporting configuration/skill data to shared locations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:36
Finding

Unpinned Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:36-39; duplicated in README.md:6-9
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete vulnerable snippets:

SKILL.md:36-39:

markdown
### 方法一：通过 ClawHub 安装
```bash
npx clawhub install smart-refinement
text

`README.md:6-9`:

```markdown
## 快速安装

```bash
npx clawhub install smart-refinement
text

### Technical Analysis

The documented installation command invokes `clawhub` through `npx` without specifying a reviewed package version or integrity value. If the package is not already available locally, `npx` may resolve and download the current package from the configured npm registry before executing its CLI code.

Consequently, the code executed during installation can change after this Skill has been reviewed. The Skill itself has no runtime dependencies and its Python implementation contains no network or command-execution logic, so dynamically executing an unpinned installer introduces avoidable supply-chain exposure beyond the minimum privileges needed by the local prompt-refinement functionality.

This finding does not establish that the current `clawhub` package is malicious. The vulnerability is the mutable and insufficiently verified dependency resolution process.

### Attack Path

1. An attacker compromises the registry account, publication pipeline, or upstream source associated with the resolved `clawhub` package.
2. The attacker publishes a malicious version under the package name resolved by `npx`.
3. A user follows the installation command from `SKILL.md` or `README.md`.
4. `npx` retrieves the mutable package version from the user's configured registry.
5. The downloaded CLI or applicable package lifecycle code executes with the privileges of the user running the installation command.
6. The malicious package can access resources available to that user before or while presenting
...[truncated 722 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a specifically reviewed version:
    bash
    npx clawhub@<reviewed-version> install smart-refinement
  2. Document the expected registry and authoritative package publisher so users can detect registry substitution or similarly named packages.
  3. Publish and verify package integrity metadata or cryptographic signatures where supported.
  4. In controlled deployments, lock the resolved installer artifact in a package lockfile or internal artifact repository after security review.
  5. Prefer a platform-provided, already trusted installer over downloading and executing a mutable package at installation time.
  6. Advise users not to run the installation command with elevated privileges and to use a restricted environment with no unnecessary secrets.
  7. Apply the corrected command consistently in both SKILL.md and README.md.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
1. 复制 `smart_refinement_system.py` 到技能目录

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The install instruction uses npx clawhub without pinning a specific package version, so users may execute whatever version is current at install time. If the package is compromised, typosquatted, or a malicious update is published, the README directly steers users into running unreviewed code on their systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises automatic integration of conversation history, project context, operation tracking, and performance monitoring, but provides no user-facing privacy notice, consent flow, retention policy, or data-boundary explanation. In an agent context, this can lead to over-collection and unintended reuse of sensitive prompts, files, or operational metadata beyond what the user expects.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The installation instruction uses npx clawhub install smart-refinement without pinning a specific package version. This creates a supply-chain risk because users may fetch whatever version is current at install time, including a compromised or malicious update, and skill-install commands are often run with broad local permissions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file describes a prompt-refinement and vector-matching system, but it also includes default skills and integrations for file operations, web access, and system operations that are broader than the stated purpose. This scope mismatch is dangerous because it normalizes capability creep and may let an apparently low-risk text-processing component broker access to higher-risk operational behaviors.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The natural-language description is written only in Chinese ("智能提示词优化与向量匹配系统") while the rest of the configuration is otherwise language-neutral. This creates a language/locale policy concern because the file presents a single forced language without any user opt-in or documented region-specific justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The configuration enables broad tool suggestions for powerful capabilities such as code execution, file writing, process control, and node/system operations without any visible constraint, approval boundary, or narrow task scoping. In a prompt-refinement/vector-matching system, exposing these operational tools increases the chance that unrelated prompts or misclassified skills could lead to dangerous actions, especially if downstream agents automatically trust suggested tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The package description is written as a Chinese-only statement describing the skill as an intelligent prompt optimization and vector matching system, with no indication that users can choose another language or that the skill is region-specific. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains user-facing natural-language documentation such as the module docstring and class description exclusively in Chinese. Under the policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language content in this skill description is primarily Chinese, and the file does not offer users an English alternative or indicate that the skill is intentionally limited to a Chinese-speaking audience. This can violate language-choice expectations because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

The skill documentation presents its operational instructions entirely in Chinese, with no indication that users may choose another language or locale. This can be a language policy issue when a skill effectively forces one language without opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The documented save_config and export_skill_data capabilities imply writing potentially sensitive configuration and skill/context data to disk, but the documentation does not warn about local disclosure, unsafe file locations, or access controls. If users export data containing prompts, context, or internal metadata, it may be exposed to other local users, backups, or accidental commits.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The surrounding comments and field name imply this method maintains general processing statistics, including average processing time. However, the average is updated only when refinements > 0, so calls that do not require refinement still increment vector match stats but are excluded from the average, making avg_processing_time inconsistent with its apparent meaning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This Python file contains natural-language user-facing text in Chinese, starting with the module description, and the rest of the script continues printing status and results in Chinese. Because the skill does not offer a language or locale choice, it may violate the language/locale policy requirement against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.