ClawHub
Back to skill

Security audit

幼儿园识字与诗歌课程体系

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently generates local printable Chinese literacy worksheets, with no artifact-backed evidence of hidden network, credential, persistence, or destructive behavior.

Install only if you want a local Chinese literacy worksheet generator. Avoid putting a child's real name in --name or saved metadata unless you are comfortable storing that information in local HTML/JSON files, and review output paths before running commands so generated files go where intended.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about producing children's Chinese learning worksheets, but the actual code does not generate educational content, tracing sheets, pinyin, poems, or printable practice pages. Instead, it performs repository/package compliance checks on local files such as SKILL.md and scripts/generate_worksheet.py, evaluates publishing-rule criteria, writes a report, and returns a pass/fail exit code. This is a materially different primary purpose, with unrelated capabilities and file-access behavior compared with the declared educational worksheet function.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_worksheet.py (reported line 9)May include surrounding context.

python
对照 skillhub 发布规范，检查本 Skill 是否满足五维红线，并输出 SHIP_REPORT.md。

  T (零外网)      扫描 scripts 是否 import 网络/进程模块
  R (零凭证)      扫描是否读取 ~/.ssh / .env / AppData / token / 浏览器缓存
  A (零注入)      扫描姓名等输入是否经 html.escape
  C (最小权限)    扫描文件写入是否限定在 --out / --json 指定路径
  E (可审计)      扫描是否写入 seed 且支持 --regen 复现

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/preflight.py (reported line 8)May include surrounding context.

python
对照 skillhub 发布规范，检查本 Skill 是否满足五维红线，并输出 SHIP_REPORT.md。

  T (零外网)      扫描 scripts 是否 import 网络/进程模块
  R (零凭证)      扫描是否读取 ~/.ssh / .env / AppData / token / 浏览器缓存
  A (零注入)      扫描姓名等输入是否经 html.escape
  C (最小权限)    扫描文件写入是否限定在 --out / --json 指定路径
  E (可审计)      扫描是否写入 seed 且支持 --regen 复现

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language content of the skill changelog is written entirely in Chinese, and there is no indication in this file that the language choice is optional or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in can constitute a locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The README is entirely written around Chinese-language content generation and invocation phrasing, with no indication that users may choose another language or that the Chinese-only scope is an explicit, justified locale restriction. Under the policy, language constraints should be opt-in or clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README suggests very broad natural-language triggers like '给孩子出一份识字练习' and similar generic educational requests, which could cause the orchestration layer to invoke this skill for ordinary Chinese-learning or worksheet requests even when the user did not specifically want this exact skill. In an agent environment, overly broad routing phrases can lead to unintended skill activation, reducing user control and potentially causing prompt-scope confusion with adjacent educational tasks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill is written as Chinese-only instructional content for parents, with no indication that another language can be used or that the locale is optional. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_skill.py (reported line 22)May include surrounding context.

python
def run(*cli, expect_ok=True):
    p = subprocess.run([PY, GEN, *cli], capture_output=True, text=True)
    if expect_ok and p.returncode != 0:
        fails.append(f"命令失败: {' '.join(cli)}\n{p.stderr}")
    return p

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The display name specifies a Chinese-language kindergarten literacy and poetry course, which is reinforced throughout the document as a Chinese learning skill. While line L073 mentions a --lang en option for worksheet output, the natural-language skill description and activation criteria do not clearly offer a user-facing language choice or opt-in, so the skill appears to assume a fixed language/locale by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file presents all user-facing content in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documented workflow explicitly writes metadata JSON and separate answer HTML files, and the parameters include a child's name field. Even though this is likely intended for convenience and reproducibility, the documentation does not warn that these artifacts may store personally identifiable information and generated educational content on disk, which can lead to inadvertent disclosure if files are shared, synced, or left on a multi-user system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file contains natural-language instructional content only in Chinese, with no indication that users may select another language or locale. Under the policy rule for language/locale constraints, forcing a specific language without documented opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This code constrains the generated worksheet language to either Chinese or English through the required --lang setting, and the surrounding natural-language content is fully determined by that choice. Because the skill is specifically a Chinese literacy worksheet generator and does expose an explicit language parameter, this is only a borderline locale-policy concern rather than a strong violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.