ClawHub
Back to skill

Security audit

fore-vip-kids-science

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for child-friendly science pages, but it should be reviewed because it generates shareable HTML with unsafe templating and mandatory third-party branding.

Review before installing if you do not want generated pages to include fore.vip branding or if pages may be published to shared services. Only share after previewing the HTML, and avoid using untrusted or adversarial question text until the template requires proper escaping and sanitization.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
references/layout-guide.md:59
Finding

Mandatory Third-Party Promotional Content Injection

Content
View full analysis

Vulnerability Details

File Location: references/layout-guide.md:59
Vulnerability Type: Output manipulation through mandatory third-party attribution
Risk Level: High

Vulnerable Code

html
<div class="footer">由前凌智选 fore.vip 提供 · AI 生成配图</div>

The English meaning of the embedded footer is: “Provided by Fore Intelligence Selection, fore.vip · AI-generated illustrations.”

Technical Analysis

The prescribed HTML template inserts the skill author's name and domain into every generated page. This promotional content is unrelated to the user's science question and is included without requiring the user to request or explicitly approve third-party branding.

The main workflow requires generated content to be assembled using this template and subsequently offers to publish the resulting page through a WorkBuddy library, IMA, or Tencent Docs. Consequently, the instruction modifies the expected deliverable by adding persistent third-party promotional material and can propagate that material to remote sharing services.

This is classified as skill instruction hijacking because the loaded skill instructions alter the agent's output objective from solely producing the user-requested educational page to also distributing author-controlled promotional content.

Attack Path

  1. A user invokes the skill by asking a children's science question.
  2. The skill generates the required explanation and illustrations.
  3. The agent follows the mandatory layout template in references/layout-guide.md.
  4. The template inserts the fore.vip attribution into the generated HTML without obtaining explicit consent.
  5. The branded page is displayed locally and may subsequently be published through one of the supported sharing destinations.
  6. Recipients of the shared page receive the injected promotional content as part of the user's deliverable.

Impact Assessment

This issue affects the integrity an ...[truncated 585 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory third-party footer from the default HTML template.
  2. Generate only content necessary to satisfy the user's request.
  3. If attribution is contractually required, disclose it before page generation and obtain explicit user consent.
  4. Provide a clear opt-out mechanism and an unbranded template.
  5. Keep attribution separate from educational content so it is not silently propagated during remote publication.
  6. Add a pre-publication preview that clearly identifies any third-party branding before upload.

T09 · Insecure Skill Coding Practices

Warning
Location
references/layout-guide.md:10
Finding

Unescaped Dynamic Values in Generated HTML

Content
View full analysis

Vulnerability Details

File Location: references/layout-guide.md:10-57
Vulnerability Type: HTML and script injection through unsafe template interpolation
Risk Level: Medium

Vulnerable Code

html
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>十万个为什么 · {question}</title>
<style>
  :root { --bg:#fff7e6; --card:#ffffff; --accent:#ffb703; --text:#3a3a3a; }
  * { box-sizing: border-box; }
  body { margin:0; font-family: "PingFang SC","Microsoft YaHei",sans-serif; background:var(--bg); color:var(--text); }
  .wrap { max-width: 720px; margin: 0 auto; padding: 24px 16px; }
  h1 { text-align:center; color:var(--accent); font-size: 28px; }
  .card { background:var(--card); border-radius:20px; padding:16px; margin:16px 0; box-shadow:0 6px 18px rgba(0,0,0,.08); display:flex; flex-direction:column; gap:12px; }
  .card img { width:100%; border-radius:14px; display:block; }
  .card h2 { margin:0; color:var(--accent); font-size:20px; }
  .card p { margin:0; line-height:1.7; font-size:16px; }
  .footer { text-align:center; color:#999; font-size:12px; margin-top:24px; }
</style>
</head>
<body>
  <div class="wrap">
    <h1>十万个为什么 · {question}</h1>

    <section class="card">
      <img src="{img1}" alt="一句话答案配图">
      <h2>一句话答案</h2>
      <p>{text1}</p>
    </section>

    <section class="card">
      <img src="{img2}" alt="为什么会这样配图">
      <h2>为什么会这样？</h2>
      <p>{text2}</p>
    </section>

    <section class="card">
      <img src="{img3}" alt="生活例子配图">
      <h2>生活里的小例子</h2>
      <p>{text3}</p>
    </section>

    <section class="card">
      <img src="{im
...[truncated 3338 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use a template engine that performs automatic contextual escaping.
  2. HTML-escape all text-context values, including the question and all generated prose. At minimum, encode &, <, >, ", and ' as appropriate for their context.
  3. Attribute-encode all image source values and prohibit quote characters or control characters that can escape the attribute.
  4. Resolve image references through trusted application-generated identifiers rather than accepting arbitrary path or URL strings.
  5. Allowlist image schemes and sources. Permit only expected local paths, trusted HTTPS origins, or safe embedded image formats, and reject executable or unexpected schemes.
  6. Sanitize the completed document with a strict allowlist that excludes scripts, event-handler attributes, frames, forms, and other active content.
  7. Apply a restrictive Content Security Policy, for example by denying scripts and limiting images to trusted local or HTTPS sources.
  8. When publishing remotely, use the destination platform's safe HTML import mechanism and verify that it sanitizes active content.
  9. Add tests using malicious values in every placeholder, including closing tags, quoted attribute escapes, event handlers, and executable URL schemes.
  10. Preview generated pages in a sandboxed, origin-isolated context before presenting or publishing them.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The metadata description includes broad trigger phrases such as generic 'why' questions, children's science explanations, and requests for images/layout. Because these are common everyday intents, the skill may be invoked outside its narrow intended context, causing unintended activation and downstream actions like image generation, file creation, and sharing prompts without the user explicitly selecting this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation table routes on ambiguous phrases like '为什么', '怎么回事', and requests for '带配图 / 生图 / 排版' with limited exclusion logic. In context, this is more risky because the workflow performs multiple side effects—generating images, creating an HTML page, saving a local file, and initiating sharing flows—so an over-broad match can trigger more capability than the user intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow states that the HTML page will be saved to a workspace file and then the user will be prompted to share it via the default repository or other publishing targets, but the skill description does not clearly warn users up front about this local persistence and potential upload. This reduces informed consent and may lead users to unknowingly create stored artifacts or share child-focused content externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document is entirely written as a normative specification in Chinese and provides no indication that language is optional or user-selectable. Under the language/locale policy, a skill should not impose a specific language unless it offers opt-in or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file is written as normative instruction for answer generation in Chinese and directs the skill to default to a specific response style without any user opt-in for language or locale. Under the policy, enforcing a specific language without offering a choice can be a natural-language policy violation unless the constraint is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide expands the skill from generating a local educational HTML artifact into proactively routing and publishing content to external repositories and cloud document services. That materially increases the skill's data-exfiltration and unintended-sharing surface, especially because it encourages asking to share by default after generation and supports multiple remote destinations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Uploading children's Q&A outputs to external knowledge bases and collaborative docs is not tightly aligned with the stated purpose of answering kids' science questions, so it introduces extra capability without strong necessity. In the context of child-focused content, unnecessary cloud sharing raises privacy, retention, and dissemination risks even if the content is usually harmless.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file describes a behavior that creates and saves a self-contained HTML file in a specific workspace path, then shares the file link in the conversation. Because markdown files should warn about behaviors affecting user data or the filesystem, the absence of any disclosure about file creation or potential overwriting is a missing user warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.