Lucasyao1985/clawdchat-analysis

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:17 AM UTC
• Version: 1.0.0

Overview

This skill coherently scrapes public Moltbook posts, filters spam, and saves a local analysis report, with no evidence of hidden execution, credential access, exfiltration, or destructive behavior.

Install this only if you are comfortable with the agent browsing public Moltbook pages and saving Markdown reports under ~/myassistant/chat/moltbook-daily/. Review or change the destination path if you do not want scraped summaries or optional raw data retained locally, and expect the skill's prompts and reports to be primarily Chinese unless adapted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/spam-rules.md (reported line 30)May include surrounding context.

--|------|------| | 🔴 硬过滤 | 完全跳过 | 明确的垃圾内容，不计入任何统计 | | 🟡 软过滤 | 降权处理 | 低质量但可能有价值，降低权重 | | 🟢 标记 | 标记但保留 | 可疑但需人工判断 |

---

硬过滤规则 (完全跳过)

1. 加密货币诈骗

特征:

text

- 包含钱包地址: 0x[a-fA-F0-9]{40}
- 包含 "send ETH/BTC/USDT to"
- 包含 "airdrop" + 钱包地址
- 包含 "double your crypto"
- 包含 "guaranteed returns"

示例:

text

❌ "Send 1 ETH to 0x742d35Cc6634C0532925a3b844Bc9e7595f..."
❌ "Free airdrop! Connect wallet at..."
❌ "Double your BTC in 24 hours!"

2. 无意义内容

特征:

text

- 纯 emoji 帖子 (内容 > 80% 是 emoji)
- 单词重复 > 5 次
- 内容长度 < 10 字符 (排除标题)
- 乱码或随机字符串

示例:

text

❌ "🦞🦞🦞🦞🦞🦞🦞🦞"
❌ "test test test test test test"
❌ "asdfghjkl"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to save analysis reports, and optionally raw scraped data, into a local path under the user's home directory without an explicit consent step or warning. This creates a real privacy and filesystem safety issue because scraped content may include sensitive or copyrighted material, and silent writes can persist data the user did not expect to store.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The README is entirely in Chinese and the listed trigger phrases are Chinese-centric except for one internal name, with no indication that users may interact in other languages or that the skill is intentionally restricted to Chinese. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file shows the skill writing a report to ~/myassistant/chat/moltbook-daily/2026-01-31.md, which affects user files. The README does not include any warning or note that the skill creates local files, where they are stored by default, or whether existing reports may be overwritten.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, and nowhere indicates that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file title and entire document are written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions, trigger descriptions, workflow, and output examples are presented entirely in Chinese, which effectively forces a specific language experience. Under the policy, language constraints should either provide user choice or be explicitly justified as region- or audience-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.