ClawHub
Back to skill

Security audit

teaching-knowledge-visualizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent teaching-material generator, but its graph-expression instructions can lead agents to generate HTML that runs unsafe JavaScript from lesson data.

Review this skill before installing if you expect to generate function-plot pages from pasted, imported, or web-sourced lesson data. The author should replace new Function with a real math parser or strict AST evaluator before broad classroom use. The Chinese language and 人教版 defaults are visible and may be appropriate for Chinese-curriculum teaching, but less suitable otherwise.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
data-format.md:527
Finding

Unsafe Dynamic Evaluation of Untrusted Mathematical Expressions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · data-format.md (reported line 394)May include surrounding context.

md
- 文本中不得出现 HTML 标签；需要强调用 emoji（⭐重点、⚠易错、📌要点）。
- 配置必须是合法 JSON（无注释、无尾逗号），写入页面前自行校验。
- 所有来自教师输入/网页检索的文本在写入 HTML 或 JSON 前必须转义：`&`→`&amp;`、`<`→`&lt;`、`>`→`&gt;`、`"`→`&quot;`、`'`→`&#39;`。
- KV_CONFIG 以 `<script>` 内嵌时，序列化后必须将 `<` 写作 `\u003c`（或转义 `</script`、`<!--`、`<script`），防止 `</script>` 提前闭合被注入脚本。
- 任何字段值不得携带可执行代码或外部资源 URL（无 `javascript:`、无 `<iframe>`、无外链图片/脚本）。默认零外部依赖（CSS/JS 全内联）；确需 CDN（MathJax/Chart.js）时须在文件头注释注明库名、版本、来源与用途，且页面主体不得依赖其加载成功（离线降级仍完整可读），详见 SKILL.md 安全规范与核心原则 6。

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · data-format.md (reported line 394)May include surrounding context.

md
- 文本中不得出现 HTML 标签;需要强调用 emoji(⭐重点、⚠易错、📌要点)。
- 配置必须是合法 JSON(无注释、无尾逗号),写入页面前自行校验。
- 所有来自教师输入/网页检索的文本在写入 HTML 或 JSON 前必须转义:`&`→`&amp;`、`<`→`&lt;`、`>`→`&gt;`、`"`→`&quot;`、`'`→`&#39;`。
- KV_CONFIG 以 `<script>` 内嵌时,序列化后必须将 `<` 写作 `\u003c`(或转义 `</script`、`<!--`、`<script`),防止 `</script>` 提前闭合被注入脚本。
- 任何字段值不得携带可执行代码或外部资源 URL(无 `javascript:`、无 `<iframe>`、无外链图片/脚本)。默认零外部依赖(CSS/JS 全内联);确需 CDN(MathJax/Chart.js)时须在文件头注释注明库名、版本、来源与用途,且页面主体不得依赖其加载成功(离线降级仍完整可读),详见 SKILL.md 安全规范与核心原则 6。

---

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown instructs that generated code comments must be in Chinese, which is a language-specific requirement. The skill does not offer an opt-in choice or explain that the skill is limited to a China-specific deployment context, so this is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction says to default to the 人教版 textbook when the teacher does not specify a version. This imposes a locale/curriculum-specific default without asking the user to choose or clearly constraining the skill to that curriculum context.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

该 markdown 文档标题与全文规范均以中文直接规定技能输出契约，且多处要求中文注释、中文反馈文案、中文文件名与中文界面文本，没有提供用户可选择其他语言/地区格式的机制。根据规则，强制特定语言而无用户 opt-in 属于自然语言层面的 locale policy 风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s instructional content is entirely written in Chinese and presents the skill guidance as a fixed-language experience, with no indication that users may choose another language or that the locale restriction is intentional and justified. The policy requires flagging language or locale constraints when they are imposed without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.