头马官员

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.0

Overview

This is a prompt-only Toastmasters role-planning skill with no hidden execution, persistence, or data access, though its README should be clearer about language scope and pinned CLI install commands.

Before installing, expect a Chinese-language Toastmasters role-planning prompt skill. It should not run commands or access private data. If you follow the README's publishing steps, pin the ClawHub CLI version instead of using an unpinned global npm install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:12-14
Vulnerability Type: Supply-chain exposure through an unpinned globally installed dependency
Risk Level: Medium

Vulnerable Code

bash

# 1. Install the ClawHub CLI (v0.23.1 is already installed locally; otherwise run the following command)
npm i -g clawhub

Technical Analysis

The documented command installs the latest version of the clawhub npm package rather than the stated, previously tested version 0.23.1. Consequently, the component installed by a user may differ from the component validated when this package was prepared or audited.

The -g option installs the package globally. npm installation can also execute package lifecycle scripts, such as preinstall, install, and postinstall, with the permissions of the invoking user. If a future package version, its maintainer account, or the configured npm registry is compromised, following this instruction could execute attacker-controlled code.

This finding does not establish that the current clawhub package is malicious. The vulnerability is the lack of dependency pinning and integrity or provenance verification in the documented installation procedure.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or the package-delivery registry.
2. The attacker publishes a malicious version under the legitimate clawhub package name.
3. A user follows README.md and executes npm i -g clawhub.
4. npm resolves the unpinned request to the attacker-controlled version.
5. Malicious lifecycle code executes during installation, or malicious CLI behavior executes when the user subsequently invokes clawhub.
6. The payload operates with the permissions of the installing user and can affect globally installed tooling and user-accessible files.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Potential impact includes ac ...[truncated 500 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to the version stated as tested:

bash

npm install --global clawhub@0.23.1

2. Review and test each new version before updating the documented pin.
3. Document the expected npm registry and package publisher so users can verify package provenance.
4. Where supported, verify package signatures, provenance attestations, or published integrity information before installation.
5. Avoid recommending elevated installation privileges. Prefer a user-scoped npm configuration or an isolated execution environment.
6. For stronger reproducibility, provide a lockfile-backed local development dependency and invoke the pinned binary through an appropriate package script instead of relying on an unconstrained global installation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill README is written only in Chinese and presents the skill name and usage exclusively in that language, with no indication that users may choose another language or that the skill is region-specific. This can violate language/locale policy when a skill implicitly mandates a specific language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L003 的触发词包含“任务分工”“角色分配”，这类表述在大量普通工作讨论中都会自然出现，缺少与 Toastmasters 场景绑定的限定条件。文档也未说明何时不应触发该技能或提供排除示例，因此存在误触发风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructional content in Chinese and does not provide any opt-in, alternative language, or justification for the language restriction, which can be read as forcing a specific language.

Content

No source excerpt is available for this finding.