ClawHub
Back to skill

Security audit

AI News Infographics

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently searches AI news and generates shareable infographic images, with no executable code or hidden privileged behavior found.

Install only if you are comfortable with generated infographic outputs being saved locally and uploaded to a CDN for sharing. Avoid putting private, confidential, or unreleased information into prompts or images intended for this workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: 64389f5483ccf2c5e859bb3c2008f5c8
    PropagateID: 64389f5483ccf2c5e859bb3c2008f5c8
    ReservedCode1: 30450220751771b398feb11d141c22a5f8d21a49f98cc2859de61cde9012a1e226caa5e0022100f9dacb20758ac8edf6a04b3aa56736260422f5f0f936656b7e6f6256f50d8390
    ReservedCode2: 3044022048c1054bd2bb4014e8f25b79f78a360beae6f1df3f8b343c6a17f015594d63680220565e641fc16b1fdb28b7711576d3287854036481cb986939e162b49265baf440
description: 生成AI新闻资讯的Infographics图片。使用场景：(1) 用户要求生成AI热门产品或新闻的图片 (2) 需要近期AI动态的可视化内容 (3) 制作OpenClaw相关的AI资讯图片 (4) 创建社交媒体分享的AI新闻卡片。功能：搜索近期热门AI产品�
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly states that generated images will be saved to the workspace and uploaded to a CDN, but the user-facing description does not warn about this external sharing behavior. This creates a privacy and data-handling risk because user-provided prompts or generated content may be persisted and publicly accessible without informed consent.

Static analysis

No suspicious patterns detected.