ClawHub
Back to skill

Security audit

Thesis Conclusion Writer

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only thesis conclusion writing skill with a minor language-label mismatch, but no evidence of unsafe behavior.

Reasonable to install if you want help drafting conclusion sections. Because the skill works from thesis content, avoid pasting confidential or unpublished material unless you are comfortable sharing it with your agent environment. Be aware that the marketplace short description emphasizes Chinese output, while the main instructions also support English and other thesis languages.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The short description hard-codes the skill as a Chinese academic conclusion writer, which can steer users toward Chinese output even though the broader skill metadata says the language should default to the thesis' dominant language unless the user requests otherwise. This creates a policy and usability mismatch that can override user expectations, reduce output correctness, and cause unintended language coercion in downstream agent selection or prompting flows.

Static analysis

No suspicious patterns detected.