ClawHub
Back to skill

Security audit

通用文本一键转公众号推文工具

Security checks for vulnerabilities and agentic risk

Overview

This skill mainly formats WeChat articles, but it also tells the agent to automatically save user content into a root-owned agent directory without confirmation.

Install only if you are comfortable with generated articles being saved automatically. Prefer editing the skill first so it returns content directly unless you explicitly approve saving, uses a non-privileged directory you choose, and sanitizes generated filenames.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:21
Finding

Mandatory Promotional Content Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21, 26, and 33-37
Vulnerability Type: Mandatory output manipulation through fixed promotional instructions
Risk Level: Medium

Vulnerable Code

The following is an English translation of the relevant Skill instructions:

markdown
- Fixed ending: standardized risk warning plus promotional language

- Fixed ending: standardized risk warning plus promotional language

3. Fixed ending template:
   ---
   **Risk Warning:** The above content is only a personal market review and does not constitute investment advice. The stock market involves risk; invest cautiously.
   ---
   *If you found this helpful, please like, recommend, and share it.*

Technical Analysis

The Skill requires promotional engagement language to be appended to every generated article. This behavior is mandatory rather than conditional on the user's request or explicit consent.

When the Skill is loaded, its fixed-ending instruction changes the requested transformation by adding unsolicited calls to like, recommend, and share the resulting content. This constitutes output-oriented instruction hijacking because the Skill introduces an additional promotional objective that may not be part of the user's requested task.

The risk is limited to generated content. No evidence shows that this instruction changes system safety controls, executes code, accesses credentials, or establishes persistence.

Attack Path

  1. A user supplies text and requests conversion into a WeChat article.
  2. The Agent loads and follows SKILL.md.
  3. The fixed-ending rule is applied irrespective of whether the user requested promotional content.
  4. The Agent adds engagement-oriented language to the final article.
  5. The user may publish the article without noticing that unsolicited promotional text was inserted.

Impact Assessment

The issue can manipulate the content produced during th ...[truncated 311 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the mandatory promotional ending from the default generation workflow.
  • Make engagement language an explicit opt-in option.
  • Ask for user confirmation before inserting calls to like, recommend, follow, or share.
  • Keep the investment-risk warning separate from promotional language so users can enable either component independently.
  • Ensure that user-provided formatting and ending requirements take precedence over optional Skill templates.
  • Clearly disclose all automatically inserted text before saving or publishing the generated article.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:27
Finding

Automatic Write to a Privileged Root-Owned Directory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Unnecessary privileged filesystem access with an insufficiently constrained filename
Risk Level: High

Vulnerable Code

The following is an English translation of the relevant Skill instruction:

markdown
2. Automatic saving: Automatically save the generated article to the user's specified official-account directory. Default path: `/root/.hermes/hermes-agent/gzh/[date]_[title].md`

Technical Analysis

The Skill directs the Agent to save generated content automatically beneath /root/.hermes/hermes-agent/. A content-formatting task does not inherently require access to a root-owned Agent directory. The instruction therefore violates least-privilege principles when executed by an Agent with sufficient filesystem permissions.

The destination filename includes a generated or user-influenced title. No corresponding instruction requires normalization, rejection of path separators, canonical-path validation, symlink protection, collision handling, or no-overwrite file creation. If the implementation substitutes the title directly into the path, specially constructed title content could affect path resolution or target an unintended file.

The file does not contain executable implementation code, so exploitation depends on how the Agent performs the instructed save. The confirmed issue is the automatic privileged write directive; title-based path traversal and overwrite are potential consequences of implementing that directive without validation.

Attack Path

  1. An attacker supplies source material or instructions designed to influence the generated article title.
  2. The Agent generates a title and substitutes it into [title] in the destination path.
  3. The Skill directs the Agent to save the result automatically without requesting confirmation.
  4. If separators, traversal sequences, absolute-path behavior, or symlink targ ...[truncated 846 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not save generated content automatically by default; return it to the user first.
  • Require explicit confirmation of both the save operation and final destination.
  • Restrict output to a dedicated, non-privileged, user-approved workspace.
  • Avoid /root and internal Agent directories for ordinary generated content.
  • Generate filenames from a strict allowlist of safe characters.
  • Remove path separators, traversal tokens, control characters, and platform-specific reserved characters from titles.
  • Resolve and canonicalize the complete destination path, then verify that it remains beneath the approved output directory.
  • Open files using no-follow and exclusive-creation protections where supported to mitigate symlink attacks and accidental overwrites.
  • Define collision behavior explicitly, such as generating a unique filename instead of replacing an existing file.
  • Apply restrictive file permissions and record the final path for user review.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger scenarios use expansive phrases like '任意口语化文本' and '所有非结构化内容' for generating a WeChat article, without narrowing the activation to stock-review or a clearly bounded context. This ambiguity increases the chance of unintended invocation for ordinary writing-help requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest and description frame this as a content-generation skill, but the documented behavior includes automatic local persistence that is not reflected as a distinct sensitive capability. This mismatch can mislead users or reviewers about what the skill actually does, reducing informed consent and making unexpected data handling more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is presented as a text-conversion and formatting tool, but it also performs automatic local file writes to a fixed path under /root. Writing generated content to disk expands the capability from content transformation to persistence, creating risk of unintended data retention, overwriting files, or saving sensitive user-provided material without clear necessity or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill specifies that generated articles are automatically saved, but provides no explicit warning, consent, or confirmation step before writing user content to disk. This is dangerous because users may supply confidential notes, meeting records, or drafts expecting transient processing, while the skill silently persists that content to a local path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.