ClawHub
Back to skill

Security audit

心理学论文结论部分的衔接与连贯润色

Security checks for vulnerabilities and agentic risk

Overview

This skill only provides a Chinese-language writing-cohesion diagnostic rubric for English psychology paper conclusions and does not request dangerous access or persistence.

Installers should expect Chinese output unless they ask the agent otherwise. The skill appears low-risk technically, but its fixed rubric and example-based thresholds should be treated as writing guidance rather than authoritative academic validation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description and title are written in Chinese and describe the skill as producing a structured diagnostic report, while the document does not offer any option for the user to choose output language. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without explicit opt-in, even though it analyzes English academic text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The rubric is written entirely in Chinese while also embedding English terminology and examples, but it does not offer any language choice, translation note, or opt-in for users who may not read Chinese. Under the policy for natural-language violations, this constitutes a language/locale constraint that is not explicitly optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file is written entirely in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This YAML example library contains substantial bilingual natural-language content, including Chinese headings and explanations alongside English example patterns. Because the file does not explain whether the skill is intentionally bilingual or offer user opt-in for language/locale behavior, it may conflict with an organizational policy requiring explicit language choice or justification.

Content

No source excerpt is available for this finding.