ClawHub
Back to skill

Security audit

Thesis Abstract & Keywords Writer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused academic writing helper for thesis abstracts and keywords, with no executable code, persistence, credential use, or hidden data handling found.

Before installing, understand that the skill is meant for thesis abstract and keyword drafting and will rely on the thesis text or excerpts you provide. Avoid sharing confidential, embargoed, or institution-restricted material unless you are comfortable processing it in your agent environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
- `摘要` and `关键词` for Chinese output, or `Abstract` and `Keywords` for English output
- Bilingual abstract and keyword sections when requested or required
- A standalone abstract that can be understood without reading the thesis
- Clear statement of purpose, method, key findings, and contribution
- Keywords that reflect the core topic and are not sentence fragments
- Same language as the thesis unless otherwise requested

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Line L404 instructs the skill to use the thesis language unless another language is requested. This sets a default language behavior without explicitly offering the user a language choice, which can conflict with a policy requiring language or locale opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.