ClawHub
Back to skill

Security audit

trump-brain-room

Security checks for vulnerabilities and agentic risk

Overview

This entertainment skill’s optional refresh workflow can run an unverified script found elsewhere on your computer.

Use explicit persona requests. Before using refresh, replace its broad script search with a reviewed updater at a fixed, trusted path, or use the documented web-search fallback. Preferences and persona corrections are saved locally; generated dialogue is fictional entertainment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · personas/refresh.md (reported line 12)May include surrounding context.

检查 scripts/update_truth_memory.py 是否存在：

bash
SCRIPT=$(find ~/.claude/plugins -path "*/trump*/scripts/update_truth_memory.py" 2>/dev/null | head -1); [ -z "$SCRIPT" ] && SCRIPT=$(find ~ -maxdepth 6 -path "*/trump*/scripts/update_truth_memory.py" 2>/dev/null | head -1); echo "SCRIPT=$SCRIPT"

如果找到脚本，运行它：

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The ordinary-agent activation rule allows invocation from a bare topic without an explicit request for the Trump persona panel.

Medium
Category
Trigger Abuse
Confidence
98% confidence
Finding

Allowing an arbitrary bare topic to activate the skill creates an overly broad trigger that could redirect an ordinary request into unsolicited political roleplay. The metadata describes narrower, user-requested activation, which reduces the risk, but the conflicting body instruction can still cause task diversion if used for skill selection; no data theft or privileged action is demonstrated.

Content

No source excerpt is available for this finding.

The persona mandates Chinese-first responses with English translations without user language opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules require predominantly Chinese output with embedded English terms and an English translation below. This imposes specific output languages without offering a user choice or documenting a locale-specific justification.

Content

No source excerpt is available for this finding.

The persona mandates Chinese output with English translations without user language opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules explicitly require primarily Chinese responses and an English translation beneath them, irrespective of the user's language. This language mandate is also stated at line 23, and the file provides neither a user language choice nor a region-specific justification.

Content

No source excerpt is available for this finding.

The persona mandates Chinese output with an English translation without user language opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules require responses primarily in Chinese and an English translation beneath them; line 27 also specifies Chinese as the primary language. These are explicit output-language requirements without user choice or a documented locale-specific justification.

Content

No source excerpt is available for this finding.

The persona mandates primarily Chinese responses with English translations without user opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules explicitly require Chinese as the primary language and an English translation underneath; line 27 reinforces this requirement. No language choice or user opt-in is provided, and the persona's context does not justify a mandatory language constraint.

Content

No source excerpt is available for this finding.

The refresh workflow searches outside the skill installation and executes the first matching Python script.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The workflow selects the first matching script across the plugin directory or, failing that, a broad search of the user's home directory, then executes it without verifying its provenance. An attacker who can place a matching file in a searched location could cause arbitrary Python execution with the agent's permissions if that file is selected. Running an updater is consistent with this skill's purpose, but discovering executable code outside the active skill installation unnecessarily expands the trust boundary.

Content

No source excerpt is available for this finding.

The persona mandates primarily Chinese responses with English translations without offering a language choice.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules explicitly require primarily Chinese output and an English translation underneath, reinforcing the language requirement at L24. These requirements apply without user opt-in or a documented locale-specific justification.

Content

No source excerpt is available for this finding.

The persona mandates primarily Chinese responses with English translations without user opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules require primarily Chinese output and an English translation underneath, regardless of the user's preferred language. No language choice, opt-in, or justified locale constraint is provided.

Content

No source excerpt is available for this finding.

The persona requires Chinese output with an English translation without offering a language choice.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules explicitly require primarily Chinese responses and an English translation below them, reinforcing the language directive on line 26. These requirements apply without user opt-in or a documented locale-specific justification; the persona's cultural framing alone does not justify forcing the response language.

Content

No source excerpt is available for this finding.

The persona mandates Chinese responses with English translations without user language opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules require primarily Chinese output and an English translation below it, regardless of the user's preferred language. No language choice, opt-in, or locale-specific justification is provided; line 26 reinforces the same restriction.

Content

No source excerpt is available for this finding.

The persona mandates primarily Chinese responses with English translations without offering a user language choice.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

Lines 59–60 explicitly require primarily Chinese output and an English translation, irrespective of the user's preferred language. Line 28 reinforces this requirement, and the file provides neither language opt-in nor a locale-specific justification.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · swap_test.py (reported line 21)May include surrounding context.

python
PROBE 6  paraphrase   —— 换个说法问同一件事，面板还一样吗？
  PROBE 7  fallback     —— 有多少问题根本没命中任何路由规则？
  PROBE 8  persona layer—— 把 10 个 persona SKILL.md 全部中性化，结构变不变？
  PROBE 9  table parity —— demo.py 里手抄的路由表 == skills/ask/SKILL.md 里的真表吗？
  PROBE 11 tie-break  —— 把「权重偏好」和「tie-break 规则」两个变量拆开：
                        只改名册顺序 / 只改权重 / 两者都改 / 权重全平后
                        看选中的人是不是直接跟着 JSON 的行序走。

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · swap_test.py (reported line 830)May include surrounding context.

python
p11["cond_D_fallback_obs"], p11["cond_D_fallback_obs"], p11["cond_D_permutations"]))
    print("         └ 面板成员变动率          %5.1f%%   （这是排序在工作，不是影响）" % (p10_disp_rate * 100))
    if parity_diff is None:
        print("  PROBE 9  table parity             跳过（找不到 skills/ask/SKILL.md）")
    else:
        print("  PROBE 9  table parity             %s" % ("✅ 两份路由表一致" if not parity_diff else "❌ %d 条不一致: %s" % (len(parity_diff), parity_diff)))
        if parity_missing:

The language rules mandate Chinese output with English translations without user opt-in.

Low
Category
Output Handling
Confidence
99% confidence
Finding

The skill explicitly requires Chinese as the primary language and English translations below it, regardless of the user's language preference. No language choice or justified locale constraint accompanies these generation rules; the demo's --en option does not provide a choice for the skill's generated dialogue.

Content

No source excerpt is available for this finding.

The self-promotion retrieval trigger matches ordinary first-person language such as “i am,” “me,” and “my.”

Low
Category
Trigger Abuse
Confidence
96% confidence
Finding

L213 instructs retrieval of the self-promotion topic whenever the user mentions common first-person expressions. Without a requirement that the request concern the tracked speaker or their posts, unrelated everyday requests can trigger this topic's retrieval.

Content

No source excerpt is available for this finding.

L077–L080 mandate Chinese-primary output with English translations without user language choice or opt-in.

Low
Category
Output Handling
Confidence
99% confidence
Finding

The language rules explicitly require Chinese as the primary language and English translations beneath it, regardless of the user's preferred language. The skill provides no language choice or documented justification for this fixed bilingual requirement.

Content

No source excerpt is available for this finding.

The skill mandates primarily Chinese output without user language opt-in.

Low
Category
Output Handling
Confidence
99% confidence
Finding

The instruction “中文为主，特朗普标志英文词嵌入” requires primarily Chinese output with characteristic English words embedded. It provides no user language choice or documented justification for imposing this language requirement.

Content

No source excerpt is available for this finding.

The persona mandates primarily Chinese responses with English translations without offering a language choice.

Low
Category
Output Handling
Confidence
99% confidence
Finding

The speaking rules explicitly require Chinese as the primary output language and an English translation beneath it, reinforcing the language requirement at line 23. No user opt-in, language choice, or justified locale constraint is provided; the persona's business and real-estate focus does not require this language restriction.

Content

No source excerpt is available for this finding.

The report emits numeric probe results even when its documented minimum-observation policy disqualifies them.

Low
Category
Excessive Agency
Confidence
98% confidence
Finding

The report exposes raw numeric probe results alongside verdicts that mark those measurements INADEQUATE or NOT_APPLICABLE, bypassing its stated minimum-observation policy. A downstream consumer could use those numbers without checking the verdicts and mistake insufficient evidence or an unobserved persona layer for a valid result; this is a low-impact reporting-integrity issue in a diagnostic entertainment tool, not an execution or data-exfiltration vulnerability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.