ClawHub
Back to skill

Security audit

食品健康管家

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Chinese-language nutrition guidance skill with no executable code, persistence, credential use, or hidden tool behavior.

Install only if you want Chinese-language food ingredient and nutrition scoring assistance. Treat its health ratings as general guidance, not medical advice, especially for children, pregnant users, patients, allergies, or diet-restricted users.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: b08e6950fdabb11760cf364b6c70eb62
    PropagateID: b08e6950fdabb11760cf364b6c70eb62
    ReservedCode1: 304502202959cc4eae762ab632b17c123a7f6b22df0473f698684e1d81f47bc59e9e5d20022100e470c2b208e16aea7e097621eb090499970c44e96dadce124c133de45bb063a5
    ReservedCode2: 3045022100f247d5b3f2014e5ab6320132967e42b4499ecd9c984c897d5faa97f63ab41d8d022066dc119ed79c9c21770437121f02ebb20397435c9b3112c34348a6d461afe524
author: liny
description: 食品健康管家。识别食品配料表，分析成分健康程度，给出打分和建议。
name: food_health_manager
tags:
    - food
    - health
    - nutrition
    - score
version: 2.2.0
---

# 食品健康管家

## 我能做什么

1. **识别配料表** - �

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and all user-facing instructions are written exclusively in Chinese, including the example interaction and output format. This effectively constrains the skill to a specific language/locale without any opt-in, alternative language support, or stated regional justification.

Content

No source excerpt is available for this finding.