ClawHub
Back to skill

Security audit

html-report

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent HTML report-generation skill with some disclosed network and Chinese-locale assumptions, but no evidence of deception, persistence, credential access, or harmful actions.

Before installing, users should know this skill is optimized for Chinese-style HTML reports and may rely on external CDNs or WebSearch for unsupported diagram structures. Avoid including confidential report details in search queries and review generated HTML before sharing it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/complex/10-diagram-types.md (reported line 33)May include surrounding context.

md
<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
    </marker>
  </defs>
  <!-- 层1：表现层 -->
  <rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
  <text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6" text-transform="uppercase" letter-spacing="1">PRESENTATION</text>
  <rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/complex/10-diagram-types.md (reported line 33)May include surrounding context.

md
<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
    </marker>
  </defs>
  <!-- 层1:表现层 -->
  <rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
  <text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6" text-transform="uppercase" letter-spacing="1">PRESENTATION</text>
  <rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/complex/10-diagram-types.md (reported line 68)May include surrounding context.

md
<line x1="510" y1="42" x2="510" y2="66" stroke="#64748b" stroke-width="1.5" marker-end="url(#la-arr)"/>
  <line x1="190" y1="100" x2="190" y2="124" stroke="#64748b" stroke-width="1.5" marker-end="url(#la-arr)"/>
  <line x1="350" y1="100" x2="350" y2="124" stroke="#64748b" stroke-width="1.5" marker-end="url(#la-arr)"/>
  <!-- 图例 -->
  <rect x="750" y="10" width="10" height="10" rx="2" fill="rgba(59,130,246,0.4)"/>
  <text x="764" y="19" font-size="8.5" fill="#64748b">表现层</text>
  <rect x="750" y="28" width="10" height="10" rx="2" fill="rgba(139,92,246,0.4)"/>

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The quality checklist requires that Chinese fonts render correctly, and elsewhere the document is predominantly Chinese with mandatory Chinese font settings. This imposes a specific language/locale expectation without indicating user opt-in or that the skill is region-specific, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The note states that Complex mode must specify Microsoft YaHei, a Chinese locale-specific font, as a mandatory requirement. Because the skill does not offer a language/locale choice or explain that it is limited to Chinese-language reporting, this is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file title and all instructional content are written exclusively in Chinese, with no indication that language selection is optional or that the skill is limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document title and all operative instructions are written exclusively in Chinese, and the skill presents its requirements as mandatory guidance for generation. There is no indication that the user may choose another language or locale, which can violate a language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file is entirely authored in Chinese and contains generation directives in Chinese without any opt-in, locale negotiation, or documented justification. In a general-purpose reporting skill, this can cause the agent to produce outputs in an unexpected language, reducing usability, confusing downstream consumers, and potentially undermining review or safety checks if operators cannot easily inspect generated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire markdown guidance is written in Chinese and specifies Chinese-oriented typography such as '覆盖中文' and Chinese font stacks, without any indication that language choice is optional. The policy allows locale constraints only when explicitly justified or offered as opt-in, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file specifies all workflow instructions in Chinese and does not indicate that the user may choose another language. The policy explicitly flags language or locale constraints when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents the entire skill guidance, labels, and examples exclusively in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file is written entirely in Chinese and presents the skill instructions and examples in that language without any visible opt-in or alternative locale guidance. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes this skill as generating HTML visualization reports in simple or complex mode, which implies local report construction rather than external information retrieval. This file explicitly instructs that when a requested diagram is not in the local library, the agent should execute a network query workflow, adding behavior beyond the described reporting function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The embedded workflow explicitly instructs the agent to perform WebSearch for diagram types outside the built-in library. In an agent environment, this can expand the trust boundary from local HTML generation to network-retrieved content, increasing exposure to prompt injection, untrusted guidance, and unintended data flow if user inputs or report context are sent to search services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file contains prescriptive natural-language instructions and examples that assume a Chinese-language audience, with no note that the skill is China-specific or that users may choose another language/locale. Under the policy rule, forcing a specific language without opt-in or justification can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This markdown file includes prescriptive locale-specific rules distinguishing '国内报告（中文）' and '国际报告（英文混排）', but it does not explicitly state that the user can choose the locale or that the skill is region-specific. Because SQP-3 applies to natural-language policy constraints, this can be read as enforcing a language/locale convention without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.