ClawHub
Back to skill

Security audit

Jingyi Module

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Chinese/E-language helper that runs local Python utilities to search and fetch Jingyi module documentation, with no evidence of hidden exfiltration, persistence, or destructive behavior.

Before installing, expect this skill to run Python locally and make requests to the official Jingyi documentation site when fetching command details. It appears benign, but check that the command index data is included or rebuilt and that the Python requests dependency is available.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description promises an end-user assistance skill with capabilities to search command names, retrieve official docs, and generate runnable 易语言 code. The provided code chunk only builds an index from a preexisting local documentation dataset (docs_clean.jsonl) into command_index.jsonl. This is related to the search/documentation domain, so it appears to be a supporting data-preparation component, but by itself it does not implement the main declared behavior. Because the actual code's primary function is offline indexing rather than user-facing search/doc retrieval/code generation, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code substantially matches part of the description: it can search command names via a local index and fetch official documentation from the 精易 site. However, a key declared capability is missing: there is no code generation of directly runnable 易语言 code. The script only retrieves and outputs documentation JSON. It also uses a local command index and hardcoded supplemental entries for certain IDs, which are implementation behaviors not reflected in the description, though these are secondary. The primary mismatch is that the declared purpose promises code generation, but the supplied code does not do that.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code chunk only implements command-index search over a local file (command_index.jsonl). That partially aligns with the 'search command names' portion of the description, but the description also claims the skill can fetch official docs and generate runnable 易语言 code, neither of which is present in this code. There is no network access, documentation retrieval, or code synthesis logic. Therefore the declared description overstates the implemented capabilities and is materially broader than the actual behavior shown.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
- `文本_取随机汉字`
- `选择字体`

## Output rules

- Output runnable 易语言 code with `.版本 2` when code is requested
- Do not mention IDE automation

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
80% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/search_jingyi.py (reported line 55)May include surrounding context.

python
score += 30

    for token in tokenize(q):
        if token in name:
            score += 35
        if token in short_name and short_name:
            score += 28

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
80% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/search_jingyi.py (reported line 63)May include surrounding context.

python
score += 20
        if token in summary:
            score += 8
        if token in keywords:
            score += 12

    return score

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file is entirely presented in Simplified Chinese and repeatedly frames the skill around Chinese-language tooling and examples, but it does not indicate that the language choice is optional or that users may interact in other languages. Under the stated policy, natural-language constraints should either be opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该文件以中文撰写并直接给出操作说明，但未说明这是面向中文用户的可选本地化版本，也未提供语言选择或适用范围说明。根据规则，若技能在自然语言层面强制特定语言且没有用户选择或明确 justified 的区域限定，可构成语言/区域策略问题。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to run local Python scripts and fetch data from an external website, but the manifest does not declare any explicit tool scope or permissions. This creates an authorization gap where code execution and network access may occur without clear sandboxing expectations, increasing the risk of unintended file or network operations if the scripts are modified or abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L22 states '默认输出中文说明', which imposes a language preference in the skill instructions. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The README describes the skill as dedicated to 精易模块 / 易语言 and presents the usage entirely in Chinese-oriented terms. This can constitute a language/locale constraint without explicitly offering users a choice or opt-in, which falls under the natural-language policy check.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.