CN Advertising Compliance

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 1.1.0

Overview

This skill is a straightforward Chinese advertising-law compliance checklist with no executable code, hidden data access, persistence, or automatic installs.

Use this as a screening aid for Chinese advertising compliance, not as legal advice. Review any optional related skills before installing them, and verify current laws or consult counsel for high-risk campaigns.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:132

Finding

Unpinned External Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 132
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

text

clawhub install cn-business-compliance-check
clawhub install cn-ecommerce-compliance

Technical Analysis

The documentation recommends installing two third-party Skills through mutable package names. It does not specify immutable versions, content hashes, verified publisher identities, or a trusted registry endpoint. Therefore, the packages ultimately retrieved may differ from those originally intended or reviewed.

This creates a supply-chain exposure if a package publisher account, registry entry, or name-resolution process is compromised. An attacker could publish altered Skill content under one of the referenced names. This project does not automatically execute those commands, and there is no evidence that either referenced package is currently malicious; exploitation requires a user or Agent to follow the installation recommendation.

Attack Path

1. An attacker compromises a referenced publisher account or otherwise gains control over package resolution for one of the named Skills.
2. The attacker publishes a modified package containing malicious instructions or executable content.
3. A user or Agent follows the installation command in SKILL.md.
4. clawhub resolves and downloads the attacker-controlled package because no immutable version or digest is required.
5. The package is activated or invoked in the Agent environment.
6. The malicious package operates with whatever tools, files, network access, and other privileges that environment grants to installed Skills.

Impact Assessment

The maximum impact depends on the permissions granted to installed Skills and the behavior of the external package. A compromised dependency could alter Agent behavior, access files exposed to the Agent, invoke available tools, or transmit accessible information. The audited pro ...[truncated 134 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the installation recommendations if the external Skills are not necessary for this Skill's operation.
2. If they are required, pin each dependency to an immutable version and preferably a verified content digest.
3. Document the expected registry, trusted publisher identity, and package provenance.
4. Verify package signatures or hashes before installation.
5. Review the complete contents of each downloaded Skill before activation.
6. Run third-party Skills with least privilege, restricting filesystem, network, credential, and tool access.
7. Establish a dependency-update process that requires security review before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file is entirely written in Chinese and provides no indication that the skill is China-specific, optional by locale, or that alternative languages are available. Under the policy rule for language or locale constraints, this is a natural-language policy issue because the skill effectively imposes a specific language without user opt-in or justification in the file.

Content

No source excerpt is available for this finding.