ClawHub
Back to skill

Security audit

Prompt Hardening

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed prompt-hardening skill with a flawed local audit script, but I found no hidden exfiltration, persistence, or destructive behavior.

Install only if you want Chinese-first prompt-hardening guidance. Avoid running scripts/audit.sh on prompt files from untrusted sources until the shell quoting and command-string issues are fixed; the advisory markdown itself is low risk.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.sh:7
Finding

Unsafe Execution of Prompt-Controlled Shell Command Strings

Content
View full analysis
'* ]]" "P7: Good/bad examples" check "[[ '$LOWER' == *'不需要'* || '$LOWER' == *'not your'* ]]" "P8: Scope limits" check "[[ '$LOWER' == *'reminder'* || '$LOWER' == *'提醒'* ]]" "P9: Drift protection" check "[[ '$LOWER' == *'信任'* || '$LOWER' == *'trust'* ]]" "P10: Trust boundary" check "[[ '$LOWER' == *'确认'* || '$LOWER' == *'verify'* || '$LOWER' == *'check'* ]]" "P11: Echo-check" check "[[ $(echo "$CONTENT" | wc -l) -gt 30 ]]" "P12: Constraint > task ratio" check "[[ '$LOWER' == *'hook'* || '$LOWER' == *'plugin'* || '$LOWER' == *'guard'* ]]" "P13: Code-level backup" check "[[ '$LOWER' == *'前置条件'* || '$LOWER' == *'precondition'* || '$LOWER' == *'gate'* ]]" "P14: State machine gate" check "[[ '$LOWER' == *'我刚才'* || '$LOWER' == *'self-correct'* ]]" "P15: Self-correction template" check "grep -q 'MUST\|NEVER\|CRITICAL' <<< '$(head -5 "$FILE")$(tail -5 "$FILE")'" "P16: First/last repetition" ``` ### Technical Analysis The `check` function accepts a shell expression as a string and attempts to execute it through an unquoted expa ...[truncated 2847 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

~/.openclaw/skills/prompt-hardening/scripts/audit.sh ~/path/to/SOUL.md

Apply hardening (read SKILL.md for the 16 patterns)

cat ~/.openclaw/skills/prompt-hardening/SKILL.md

text

## When to Use

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrase 'prompt 优化' is broad enough to match many ordinary prompt-editing requests that are unrelated to security hardening. That can cause accidental invocation of a security-focused skill in inappropriate contexts, steering workflows toward constraint-heavy rewrites or advice that the user did not intend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Lines L151-L152 describe the skill as advisory/planning only and explicitly say it does not modify target prompts automatically. However, the Usage and Output Artifacts sections describe producing a '重写后的 prompt 文件' after reading and auditing the target prompt, which contradicts the claim of being non-modifying advisory guidance. This is an intent-level documentation contradiction within the skill file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s instructional content is overwhelmingly written in Chinese and presents the guidance as the required operating language, with no indication that users or downstream agents may choose another language. Under the language/locale policy, forcing a specific language without explicit opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The file presents the primary description in Chinese with some English text, but does not state that users may choose their preferred language or that the locale is intentionally constrained to a specific audience.

Content

No source excerpt is available for this finding.