ClawHub
Back to skill

Security audit

qa-input-validation

Security checks for vulnerabilities and agentic risk

Overview

This is a QA input-checking skill with no executable code or persistence; the main cautions are broad activation wording and an unpinned install suggestion for a related skill set.

Install only if you want a Chinese-language QA input-validation helper. Avoid pasting real customer, payment, identity, or production data unless it is masked. Treat the unpinned `npx` command as optional related-package guidance and prefer a pinned or trusted source if installing the broader skill set.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation description includes broad triggers such as unclear requirements, insufficient information, or vague user input, which can match many ordinary conversations. Over-broad auto-activation can cause the wrong skill to intercept requests, increasing the chance of workflow confusion, denial of intended functionality, or unintended prompting for documents and context the user did not mean to provide. In a testing assistant, this can also over-collect potentially sensitive requirement material.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The when-to-use field repeats the same ambiguous auto-activation criteria, reinforcing broad routing behavior at the metadata layer. Because routing systems may rely heavily on metadata, this increases the likelihood of false activation and inappropriate handling of user conversations. The danger is contextual rather than directly code-execution-related, but it can still undermine correctness and privacy expectations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill advertises installation via npx skills add Kokxi/qa-test-skills without pinning an exact package/version. That creates a supply-chain risk: future package changes, account compromise, or typosquatted resolution could cause users to fetch and execute unintended code when following the documentation. In skill context this is more dangerous because npx commonly executes downloaded package code immediately.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The main skill contract says that if input validation fails, the agent must return a missing-information list and ask the user to supplement it. But the exception guidance allows proceeding to output a 'minimal usable test case set' even when the user refuses to provide information, which weakens the safety/quality gate and can cause downstream testing artifacts to be generated from insufficient or contradictory input. In an automated workflow, this can bypass intended controls and produce misleading or unsafe outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains all user-facing guidance and output examples only in Chinese, which can impose a language-specific constraint without user opt-in. Under the natural-language policy rules, forcing a specific language without offering a choice or documenting a justified locale limitation is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file primarily instructs in Chinese but also includes the English sentence 'Use when the user asks about...' in the core description. This introduces a language-specific presentation choice without indicating user preference, which may conflict with a language/locale neutrality policy.

Content

No source excerpt is available for this finding.