ClawHub
Back to skill

Security audit

guess-number

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple disclosed number-guessing game that stores only its own temporary game state locally.

Install only if you are comfortable with a Chinese-language guessing-game skill that creates two small temporary files in its own script directory while a game is active. No credential access, network activity, or system persistence was found.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
import sys
import os

SECRET_FILE = os.path.join(os.path.dirname(__file__), 'secret.txt')
STEP_FILE = os.path.join(os.path.dirname(__file__), 'step.txt')

def generate_secret():

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
import sys
import os

SECRET_FILE = os.path.join(os.path.dirname(__file__), 'secret.txt')
STEP_FILE = os.path.join(os.path.dirname(__file__), 'step.txt')

def generate_secret():

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
import sys
import os

SECRET_FILE = os.path.join(os.path.dirname(__file__), 'secret.txt')
STEP_FILE = os.path.join(os.path.dirname(__file__), 'step.txt')

def generate_secret():

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
import sys
import os

SECRET_FILE = os.path.join(os.path.dirname(__file__), 'secret.txt')
STEP_FILE = os.path.join(os.path.dirname(__file__), 'step.txt')

def generate_secret():

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
import sys
import os

SECRET_FILE = os.path.join(os.path.dirname(__file__), 'secret.txt')
STEP_FILE = os.path.join(os.path.dirname(__file__), 'step.txt')

def generate_secret():

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
import sys
import os

SECRET_FILE = os.path.join(os.path.dirname(__file__), 'secret.txt')
STEP_FILE = os.path.join(os.path.dirname(__file__), 'step.txt')

def generate_secret():

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/guess_number.py (reported line 6)May include surrounding context.

python
import sys
import os

SECRET_FILE = os.path.join(os.path.dirname(__file__), 'secret.txt')
STEP_FILE = os.path.join(os.path.dirname(__file__), 'step.txt')

def generate_secret():

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

文件整体以中文规定技能描述、触发词和交互内容，但没有说明这是区域限定技能，也没有提供用户语言偏好的选择。按规则，强制特定语言且缺少用户选择或正当说明，属于自然语言层面的语言/locale policy 问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes a catch-all phrase like '其他类似表达想要玩猜数字游戏的请求', which is overly broad and can cause the skill to activate on loosely related inputs. This is not a direct security exploit, but it can misroute user requests, invoke unnecessary commands, and increase the chance of unsafe or unintended skill execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This Python file contains user-facing docstrings, prompts, validation messages, and usage text entirely in Chinese, such as the startup prompt and CLI help output. Because the skill does not offer any language selection or document a justified locale restriction, it violates the natural-language policy rule against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.