Daily Vocab

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a vocabulary-card generator, but it also includes under-disclosed recurring push-notification scheduling to external chat channels.

Review this skill before installing if you do not want scheduled messages. Do not run push-toggle.js unless you intend to create recurring push jobs, and verify/remove cron entries after testing. Expect generated cards to use web search, write /mnt/user-data/outputs/daily-vocab.html, include Chinese translations, and contain an empty ad-ready area plus ClawCode footer branding.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:64

Finding

Mandatory Advertising and Third-Party Branding in Generated Artifacts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–65
Vulnerability Type: Forced promotional output through skill instructions
Risk Level: High

Vulnerable Code:

markdown

- **Ad-ready zone**: `<div id="ad-slot-bottom">` below the card (min-height 90px).
- **Footer**: "Powered by ClawCode"

Technical Analysis

The skill instructions require the agent to include an advertising container and third-party branding in every generated vocabulary artifact. These requirements are unrelated to the core vocabulary-learning functionality and alter the expected output by mandating unsolicited promotional content.

The advertising container is initially only an empty HTML element, and no executable advertising script is present in the audited project. Nevertheless, reserving a mandatory advertising surface can facilitate subsequent ad injection when the generated artifact is modified, embedded, or processed by another component. The forced footer also causes the agent to present third-party attribution regardless of whether the user requested or consented to it.

This is classified as skill instruction hijacking because the behavior originates in the skill text and directs the agent to modify its generated output for a secondary promotional purpose.

Attack Path

1. A user installs or invokes the daily-vocab skill for vocabulary-learning content.
2. The agent loads and follows the instructions in SKILL.md.
3. During HTML generation, the agent inserts an element named ad-slot-bottom with a minimum height of 90 pixels.
4. The agent also inserts the mandatory Powered by ClawCode footer.
5. The resulting artifact contains unsolicited promotional infrastructure and branding.
6. If another system later identifies and populates the advertising element, advertisements or other third-party content may be injected into the artifact.

Impact Assessment

The immediate impact is limited to t ...[truncated 607 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory ad-slot-bottom element from the visual design requirements.
2. Remove the mandatory Powered by ClawCode footer unless it is legally required and accurately identifies the responsible product.
3. If advertising or attribution is supported, make it explicitly optional and require informed user consent before including it.
4. Keep generated artifacts focused on the user-requested vocabulary-learning function.
5. Document any optional third-party content, including its source, purpose, privacy implications, and loading behavior.
6. If an optional advertising integration is later implemented, prohibit arbitrary script injection, apply a restrictive Content Security Policy, allowlist content origins, and prevent the ad container from receiving unsanitized HTML.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The file advertises a vocabulary-learning feature but also documents push-management commands, external channel delivery, and scheduling controls. This is a significant scope expansion because notification delivery and cross-channel messaging can reach users outside the immediate interaction context, creating consent, abuse, and privacy risks if not clearly declared and permissioned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The file advertises a vocabulary-learning feature but also documents push-management commands, external channel delivery, and scheduling controls. This is a significant scope expansion because notification delivery and cross-channel messaging can reach users outside the immediate interaction context, creating consent, abuse, and privacy risks if not clearly declared and permissioned.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README repeatedly frames the skill as delivering English vocabulary content only, including 'English Vocabulary Learning Skill' and 'one high-value English vocabulary word per day,' but does not offer users a language choice or explicitly justify the locale restriction as region-specific. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The Chinese keyword "每日词汇" is a generic phrase that can match ordinary requests for daily vocabulary study rather than this specific workflow and output format. The manifest does not provide narrowing conditions, exclusion examples, or a clearer invocation boundary to prevent accidental activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest keyword list includes the standalone term "vocabulary," which is a very generic phrase commonly used in everyday learning conversations. Without constraints or exclusion conditions, this can cause the skill to match many unrelated requests about vocabulary rather than explicit invocation of this specific daily-word skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The keyword "English learning" describes a large general domain rather than a distinct trigger for this skill. Users discussing grammar, pronunciation, conversation practice, or test prep could unintentionally collide with this manifest keyword even when they do not want a daily vocabulary card.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow requires definitions in "EN + CN" and example sentences "with CN translation," making Chinese-language output mandatory for all users. This is a language policy issue because the skill does not provide an option to choose another language or opt in to Chinese translations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Including push-notification management and multi-channel delivery commands in a skill presented as a simple vocabulary card generator introduces hidden operational scope. Even if the commands are not automatically executed, documenting them within the skill can normalize undeclared messaging capabilities and mask functionality that should undergo separate review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Push subscription and cross-channel notification features are not necessary for generating a local vocabulary card and therefore violate least-privilege expectations. Unjustified messaging capability increases the risk of spam, unwanted contact, or misuse of user identifiers and channel routing information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The generated user-facing prompt is entirely in Chinese, and the file provides no option for the user to select another language or opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script emits only Chinese user-facing text, including the invalid userId error and the generated prompt content, and provides no option to select language or locale. This is a natural-language policy concern because it imposes a specific language on all users without opt-in or justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Selecting among multiple chat platforms and constructing channel-specific session keys is a messaging-integration capability, not an obvious requirement of a vocabulary skill as described. The manifest does not mention chat integrations, notifications, or external delivery channels, so this capability appears contextually out of scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Multiple user-visible strings, including validation errors and status messages, are presented only in Chinese. This forces a specific language on users without opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a content skill that provides one advanced English word per day with pronunciation, etymology, examples, and quiz mode. This file goes beyond content generation and manages recurring cron jobs plus user-specific delivery over Telegram/Feishu/Slack/Discord, which is a behavioral expansion not stated in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The workflow instructs the agent to use web_search, which performs a network action to fetch external information. The markdown does not warn users that external web queries will be made as part of generating the card, which is a missing disclosure under the file's described behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs saving an HTML file to /mnt/user-data/outputs/daily-vocab.html, which is a file write affecting user storage. The markdown does not include any warning or disclosure that the skill will create or overwrite this file, so the user may not realize persistent output is being written.

Content

No source excerpt is available for this finding.