Security audit

ClawHub 中文 Skill 查询

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed ClawHub lookup and optional alerting helper, with no hidden code or credential handling found.

Install this if you want a helper for finding Chinese-language ClawHub skills. Before enabling the optional daily cron report, confirm the exact schedule and that messages will be delivered only to your intended channel or account.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger description uses broad language such as 'or similar requests,' making activation boundaries unclear. Ambiguous invocation criteria can cause the agent to run the skill in contexts the user did not specifically intend, which is more concerning here because the skill also contains browsing and optional scheduling behavior.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: 描述明确写明“筛选中文用户上传的 skill 并汇报给用户”，整体技能内容也默认以中文技能为唯一目标，但未说明这是用户可选的语言偏好。根据该规则，强制单一语言/locale 且未提供选择或正当限定理由，属于自然语言策略违规。

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The 'When to Use' examples end with open-ended wording like 'etc.,' without defining exclusions or boundaries. This can lead to over-triggering and unintended execution, especially since the skill can browse external content and optionally configure recurring jobs.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill expands a simple on-demand listing function into persistent monitoring with scheduled delivery to the user's channel. That creates a capability for ongoing unsolicited messaging and user-targeted automation beyond the core purpose, increasing the risk of abuse, accidental spam, and privacy issues if the wrong delivery target is configured.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The documented cron creation, target management, update, removal, and test-run workflow introduces operational capabilities unrelated to merely listing the latest Chinese skills. This scope expansion enables persistent background actions and message delivery mechanics that could be repurposed for unwanted notifications or delivery to unintended recipients.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs creation and testing of recurring tasks that proactively deliver messages to the current channel, but it does not require a clear user warning or consent flow about persistent notifications. This is dangerous because it can surprise users with ongoing pushes, spam a channel, or leak results to an unintended conversation if delivery metadata is wrong.

Static analysis

No suspicious patterns detected.