ClawHub
Back to skill

Security audit

Zhougong Dream

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is a simple dream-interpretation tool, but its install instructions use mutable and inconsistent package names that could cause users to install different code than the reviewed artifact.

Install only if you trust the publisher and can verify the canonical package name. Prefer a pinned version or integrity-verified install path, avoid running installation with elevated privileges, and treat dream and luck interpretations as entertainment or reflection rather than medical, financial, legal, or mental-health advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Mutable and Inconsistent Installation Dependencies Create Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
install zhougong-dream-analysis@ ``` 2. Select one canonical package identifier and use it consistently in `SKILL.md`, `README.md`, and `skill.json`. 3. Pin package integrity using a lockfile, registry-provided integrity digest, signed release, or documented SHA-256 checksum. 4. Publish packages only through a verified organization or namespace and document the expected registry and publisher identity. 5. Disable npm lifecycle scripts during retrieval where operationally possible, and execute any required installation logic only after reviewing it: ```bash npm_config_ignore_scripts=true npx clawhub@ ... ``` 6. Avoid running installation commands with administrator or root privileges. Use an isolated, least-privileged account or sandbox. 7. Add automated release checks that reject mutable dependency versions, inconsistent package names, missing integrity metadata, and unexpected lifecycle scripts. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation logic is triggered by very common phrases such as "dream analysis," "dream interpretation," "解梦," and "梦见," which are likely to appear in ordinary conversation. This can cause unintended skill invocation, hijacking unrelated user requests and increasing the chance that the agent follows this skill when the user did not explicitly opt in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documents shell-based installation and execution behavior but does not declare any tool scope or allowed tools. In an agent ecosystem, this can cause overbroad execution authority or unclear trust boundaries, increasing the chance that the skill is invoked with shell access beyond what users expect.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx clawhub@latest install zhougong-dream pulls and executes the latest remote package version at runtime, which is a classic supply-chain risk. If the upstream package or dependency chain is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases are broad conversational examples without clear activation boundaries, so an agent may invoke this skill on loosely related user inputs. In this skill's context, over-triggering is more concerning because the output includes superstition- and guidance-oriented recommendations, which could be inappropriately injected into unrelated or sensitive conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file repeatedly treats bilingual output as a fixed requirement ('全双语输出正常') and tests only Chinese/English output, with no indication that users can select another language or opt out. SQP-3 applies because this is a natural-language locale policy concern: the skill appears to force a specific language presentation without user choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description declares activation on highly generic phrases such as 'dream analysis', '解梦', '梦见', and '梦到', which can appear in ordinary user conversation without an explicit request to invoke this skill. This can cause over-triggering, unintended routing, and interception of broad dream- or mental-health-related conversations by a culturally specific interpretation tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The provided tool trigger list includes generic terms like 'dream analysis', 'dream interpretation', '解梦', and '梦见' without scope constraints or explicit invocation semantics. In practice, this increases the chance that the tool is selected during normal conversation, potentially displacing safer general responses and inappropriately handling emotionally sensitive content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The function signature sets lang="zh" as the default, which forces a specific language unless the caller explicitly overrides it. This is a natural-language policy concern because the skill does not ask for user preference or document an opt-in before defaulting to Chinese.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · trigger.py (reported line 18)May include surrounding context.

python
# 调用解梦脚本
    cmd = ["python", "scripts/zhougong_dream.py", "--dream", dream_text, "--lang", lang]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True)
        return result.stdout
    except Exception as e:
        return f"解梦失败: {str(e)}"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README states the system is bilingual and appears to apply Chinese/English behavior by default without indicating user preference or opt-in. While not directly a code execution risk, this can lead to unwanted output shaping, user confusion, and reduced user control over how the agent responds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The report showcases dream interpretation and 'luck' advice as a feature without any disclaimer that the output is entertainment/cultural content rather than reliable guidance. Even though this is a test report rather than executable code, documenting and validating superstition-style advice without warnings can normalize decision-influencing content and increase the chance that downstream integrators present it as trustworthy advice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This file is a code file, so SQP-3 applies to natural-language policy concerns in code behavior. The function defaults language to "zh", and the CLI also defaults --lang to "zh", which imposes a specific language unless the user overrides it rather than prompting for or negotiating language preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The argument parser sets --lang to zh by default, causing the tool to produce Chinese output unless the user knows to override it. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.