ClawHub
Back to skill

Security audit

AgentYMLgenerator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple Dify YAML generator with no executable code or persistence, but its activation rules and output instructions are somewhat overbroad and inconsistent.

Install this only if you want a Chinese-language helper for generating Dify workflow YAML. Review generated YAML before importing it into Dify, especially when using sensitive SOPs or business documents, because the skill may activate broadly and its output-format instructions are inconsistent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill mandates proactive invocation for very broad triggers, including generic business-process descriptions and pasted SOP documents, which can cause the agent to seize control in contexts where the user did not explicitly request YAML generation. This increases the risk of prompt-routing abuse, unintended handling of sensitive operational documents, and inappropriate tool use that bypasses normal intent confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description hard-codes Chinese-language behavior without checking the user's preferred language or documenting a justified locale restriction. In practice this can cause misleading output, reduce user comprehension of generated configurations, and make review of security-sensitive workflow logic harder for non-Chinese users, increasing the chance of unsafe deployment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

L44 与 L73 明确要求“仅输出纯 YAML/无任何解释文字”，但 L79-L82 又要求先简要说明工作流结构、再输出 YAML 代码块并附加导入提示。这些指令会导致技能文档内部对预期输出形式给出相互冲突的意图说明。

Content

No source excerpt is available for this finding.