ClawHub
Back to skill

Security audit

企业级 Web UAT 验收测试

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent enterprise UAT workflow, but its bundled HTML report template can render copied test content as active browser content if used without escaping.

Review before installing if you plan to generate HTML reports. Use a generator that escapes all scalar fields, sanitizes any rich blocks, validates URLs, and keeps secrets, personal data, cookies, and tokens out of evidence. The UAT workflow itself has sensible authorization boundaries for high-risk actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
assets/report-template.html:96
Finding

Unescaped Template Placeholders Permit HTML and Script Injection in Generated Reports

Content
View full analysis

{{MODULE_NAME}}

Module conclusion:{{MODULE_CONCLUSION}}

Covered submenus

{{COVERED_MENUS}}

Formal issues

Formal ISSUE {{ISSUE_ID}}｜{{ISSUE_TITLE}}

URL:{{PAGE_URL}}

Reproduction steps:{{REPRO_STEPS}}

Expected result:{{EXPECTED}}

Actual result:{{ACTUAL}}

Evidence:{{EVIDENCE_REF}}

{{FORMAL_ISSUE_BLOCKS}} ``` Additional raw block placeholders, including `{{MODULE_TAB_BUTTONS}}`, `{{EVIDENCE_FIGURES}}`, and `{{MODULE_SECTIONS}}`, occur elsewhere in the same template and increase the exposed rendering surface. ### Technical Analysis The HTML report template places scalar values and generated content blocks directly into executable HTML contexts. The project does not define contextual output encoding, a strict HTML sanitizer, or a trusted rendering boundary for these placeholders. UAT data can originate from an application being tested, including page titles, displayed messages, URLs, issue descriptions, actual results, and evidence captions. Such values must be treated as untrusted. If report generation replaces a placeholder verbatim, attacker-controlled markup can become active HTML. For example, a tested application could display content containing an element with an event handler. If that content is copied into `{{ACTUAL}}`, `{{ISSUE_TITLE}}`, or another placeholder without encoding, the browser may execute it when a reviewer opens the generated report. Whole-block placeholders are especially sensitive becaus ...[truncated 1461 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill content is written entirely in Chinese and does not state that language selection is optional or configurable. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The HTML declares lang="zh-CN" and the report title/content labels are written in Simplified Chinese, which imposes a specific language/locale in the generated artifact. The file does not indicate any user opt-in, configurability, or region-specific justification for this locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The document title and all template content are written entirely in Chinese, which constitutes a language-specific instruction artifact without any indication that users may choose another language or that the constraint is region-specific. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The title and entire standard are written as mandatory operating guidance in Chinese, with no indication that users may choose another language or that the standard is limited to a China-specific or Chinese-only compliance context. Under the policy, forcing a specific language without opt-in or documented justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains user-facing instructions only in Chinese, which can amount to a language/locale policy issue when no opt-in or alternative language is provided. The file does not state that it is intended solely for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.