ClawHub
Back to skill

Security audit

Star Mansion Master

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only Chinese astrology and social-content skill with disclosed local preference storage and no hidden code, network access, credential access, or destructive behavior.

Install only if you want Chinese-language star-mansion content and compatibility copy. Review generated relationship advice and promotional calls to action before using or posting them, and treat the readings as cultural or entertainment content rather than a basis for personal decisions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
references/compatibility/output-template.md:75
Finding

Hardcoded Promotional Call to Action Alters Generated Content

Content
View full analysis

Vulnerability Details

File Location: references/compatibility/output-template.md, lines 75-84
Vulnerability Type: Hardcoded output instruction that redirects generated content toward follower acquisition
Risk Level: Medium

Vulnerable Code

The following is a complete English translation of the affected source segment:

markdown
**Card 4 (Advice and Conclusion):**
text
📝 Relationship Advice
1. {Advice}
2. {Advice}

⚠️ Star mansions reveal tendencies; they do not determine destiny.
Follow me to see your star-mansion compatibility →
text

### Technical Analysis

The compatibility template mandates a promotional follower-acquisition message as part of generated carousel content. This instruction is not conditional on the user requesting advertising, engagement optimization, or a call to action.

`SKILL.md` directs the agent to use the compatibility output template when producing compatibility readings. Consequently, loading and following the skill can alter the agent's output objective from solely fulfilling the user's compatibility-content request to also promoting a social-media account.

This is classified as instruction hijacking because the embedded template instruction controls part of the agent's generated response for an undeclared promotional objective. The behavior does not execute code, access credentials, or bypass system permissions.

### Attack Path

1. A user requests carousel-style social-media content about star-mansion compatibility.
2. The agent follows the skill workflow and loads `references/compatibility/output-template.md`.
3. The agent selects the series-card template.
4. The fourth card includes the mandatory follower-acquisition message.
5. Unless the user or agent manually removes it, the promotional text appears in the generated content and may subsequently be published.

### Impact Assessment

The issue can cause users to unknowingly include promo
...[truncated 377 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the fixed follower-acquisition message from the default compatibility template.
  2. Add promotional calls to action only when the user explicitly requests marketing or engagement-oriented copy.
  3. Represent promotional content as an optional placeholder, disabled by default, such as:
    text
    {optional_call_to_action}
  4. Ask for confirmation before inserting follower acquisition, paid-service promotion, direct-message solicitation, or other conversion-oriented language.
  5. Separate neutral compatibility templates from marketing templates so that ordinary readings cannot silently inherit promotional instructions.
  6. Add a content-generation rule requiring generated output to remain aligned with the user's stated purpose and prohibiting undeclared promotional additions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The activation description is broad enough to trigger on general astrology or compatibility queries without clear boundaries, which can cause the skill to engage outside its intended scope. In an agent setting, overbroad routing increases the chance of irrelevant or misleading advice being presented as authoritative, especially for relationship or personality decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The comment-reply example "能帮我看看吗？" is vague and can activate the skill for underspecified requests, causing it to infer personal-analysis intent where none was clearly given. This is risky in social or parasocial contexts because the agent may produce personalized occult guidance or funnel users toward private or paid interaction without sufficient scope checks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file explicitly constrains replies to Chinese-only style rules without any mechanism to detect or honor the user's preferred language. This can cause the agent to ignore user language expectations, reducing usability and potentially misleading users who believe the system can interact safely and clearly in their language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown template forces a specific language/locale for all generated output, and there is no natural-language indication that users can opt into another language. Under the policy, fixed language behavior without user choice or justification is a reportable locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file contains user-facing questions and answer options only in Chinese, which can impose a language requirement on users without opt-in. The policy allows locale constraints only when they are explicitly justified or when the user is offered a language choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The persona mandates '中文为主' as the primary language, which imposes a language preference without indicating user choice or opt-in. This is a natural-language policy concern because the skill appears to force a locale/language behavior rather than adapting to the user's preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is entirely written in Chinese and does not indicate that the language choice is optional, user-selected, or justified by a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains only Chinese-language instructions and reference data, which can be interpreted as forcing a specific language/locale without user opt-in. The policy category applies to all file types, and there is no indication that users may choose another language or that the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file is written entirely in Chinese and presents the skill content in that language without any indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file presents strong relationship-risk classifications such as '最危险', '千万不要入局', and emotionally loaded compatibility rankings that can influence users' romantic decisions, but it does not include a sufficiently prominent safety warning about emotional impact, uncertainty, or the risk of over-relying on pseudoscientific guidance. Although section seven adds a mild disclaimer, it is brief and undermined by the rest of the document's authoritative and prescriptive framing, so users may still treat the content as decision-making advice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.