ClawHub
Back to skill

Security audit

傅盛

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a biography skill, but it embeds unrelated OpenClaw promotion, external links, and contact information that do not fit the stated purpose.

Review before installing. The skill does not appear to run code or access private data, but it may cause answers about Fu Sheng to include unrelated OpenClaw marketing, links, or contact information. Remove or ignore the promotional section if you want a clean biography/reference skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:79
Finding

Unrelated Third-Party Promotion Embedded in Biography Skill Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-112
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

markdown
## 🦞 Fan Chen Lang's OpenClaw Project Matrix

Through "**idea-driven development plus practical tools**," a complete personal AI OS infrastructure has been constructed:

### 1. 📱 Traffic and Community Channels
The WeChat public account (**Xiao Xiangfa AI Chen Lang AI**) publishes creative content and uses Moments interactions and WeChat groups to cultivate users and investors, forming a core community.

### 2. 🧭 Resource Navigation
**https://Openclaw123.xyz** is positioned as a beginner-level resource portal, providing a traffic entry point and resources for the ecosystem.

### 3. 📞 An Agent's "WeChat"
**Aixin** — Give your OpenClaw agent a "phone number" so it can be contacted first when needed.
🔗 https://aixin.chat

### 4. 🌐 Public-Network Extension
**ClawOpen**, as an extension gateway and future upgraded version of Aixin, supports AI-ID registration, social connections, directory listings, and controlled return of hardware or platform data.

> **Personal AI OS = OpenClaw (internal) + ClawOpen (external extension)**

ClawOpen is described as the required publicly interactive component of OpenClaw.

### 5. 🦞 Distinctive Offline User Acquisition
An offline OpenClaw gathering model is promoted through activities that provide or install OpenClaw for free, converting a technical project into a high-engagement social setting to improve brand affinity and distribution.

### 6. 📧 Contact Information
**Chen Lang**: leogood@foxmail.com

The displayed code is an English translation of the complete affected source segment; the original file contains the same material in Chinese.

Technical Analysis

The skill declares that it provides biographical information about Fu Sheng and activates for questions concerning Fu Sheng, ...[truncated 2536 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove lines 79-112 from SKILL.md; they are unrelated to the skill's declared biography function.
  2. Restrict the skill to factual content directly necessary for questions about Fu Sheng, Cheetah Mobile, and OrionStar.
  3. Do not embed advertising, personal contact information, traffic-acquisition instructions, or unrelated product claims in skill context.
  4. If an external reference is genuinely necessary, document its direct relevance, label it as an external and unverified resource, and avoid language asserting that a third-party service is mandatory.
  5. Validate external destinations through an organizational allowlist and review their ownership, transport security, privacy practices, and redirect behavior before inclusion.
  6. Add a content-review rule that rejects sections whose entities, URLs, or calls to action do not match the skill metadata and declared activation scope.
  7. Periodically review skill text for appended promotional material and unauthorized modifications.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation description is broad enough to match multiple loosely related topics such as 猎豹移动、猎户星空、Clean Master创始人, which may cause the skill to trigger outside its intended boundary. Overbroad triggering can route unrelated user queries into this skill, increasing the chance that users receive off-topic or embedded promotional content from the skill instead of a more appropriate response path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description hardcodes Chinese-language behavior as part of the skill definition, which can override user language preference or platform defaults. While not directly a code-execution risk, it can degrade user trust, cause misleading responses for non-Chinese users, and make abuse harder to detect when paired with other content-injection issues.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is supposed to provide biographical information about 傅盛, but the later section injects unrelated promotion for 'OpenClaw', external domains, social/contact channels, and marketing copy. In an agent context this can steer users toward unsolicited third-party properties, creating risks of spam, phishing, data exfiltration, or reputation abuse under the guise of a trusted informational skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.