ClawHub
Back to skill

Security audit

ZeroToken

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed token-saving and encoding/workflow helper, with file and command utilities that match its stated purpose.

Install only if you want a concise-output workflow and the bundled file-encoding utilities. Be aware it may guide the agent to read or modify project files, run local helper scripts, write .zerotoken/environment.json, and adjust current-repository git quotepath on Windows; review commands before using conversion or repair modes on important files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
### Changed
- Restructured SKILL.md: decision table at top, then core principles (5 from 8), then task modes with concrete tool mappings.
- Tightened all sections—removed redundancy across core principles, task modes, and output rules.
- Updated agents/openai.yaml default_prompt to match new decision-table-first flow.

## [1.0.3] - 2026-04-27
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Hidden Instructions

High
Category
Prompt Injection
Content
<#
.SYNOPSIS
    Windows/PowerShell + 中文环境初始化脚本
.DESCRIPTION
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
This file presents the skill's operational instructions primarily in Chinese, including required procedures and constraints, but does not state that the user may choose another language. That can violate a language/locale policy when users are implicitly forced into a specific language without opt-in.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The skill description is presented in Chinese and does not indicate that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The file is written as a mandatory execution specification and states that any generated or modified code, configuration, or documentation must comply with it. Because the instructions are presented only in Chinese and framed as mandatory, this imposes a language/locale constraint without user opt-in or an explicit region-specific justification.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation text says the skill triggers whenever a task needs external information, with examples spanning news, people, companies, social content, and real-time info. This scope is very broad and does not define clear boundaries or negative examples, so it could cause unintended invocation for many common user requests.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The file title and all operational guidance are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is justified or optional.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The file explicitly states the mode auto-enables on Windows/PowerShell and 'does not require the task to involve Chinese.' Combined with the document’s pervasive Chinese-language operating guidance, this imposes a language/locale-specific workflow automatically rather than offering user choice or opt-in.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The module docstring and CLI descriptions are entirely in Chinese, including the stated output format and usage guidance. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale/language constraint.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The module docstring and later guidance repeatedly assume Chinese output/support as a built-in requirement, such as persisting '中文支持能力' and tailoring workflow around Chinese text handling. This imposes a specific language/locale expectation rather than offering a user choice or documenting an explicit region-specific constraint.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
name = Path(exe).name.lower()
    info["edition"] = "powershell-core" if name.startswith("pwsh") else "windows-powershell"
    try:
        completed = subprocess.run(
            [exe, "-NoProfile", "-Command", "$PSVersionTable.PSVersion.ToString()"],
            capture_output=True,
            text=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
pass

        try:
            git_quotepath = subprocess.run(
                ["git", "config", "--get", "core.quotepath"],
                capture_output=True,
                text=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The generated workflow text directs users to write and verify files 'with Chinese' and describes mode behavior around Chinese/CJK content as standard operating procedure. Because this natural-language guidance is emitted to users/agents without an opt-in or justified locale restriction, it conflicts with the policy against forcing a specific language or locale.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The synopsis and description explicitly frame the script as a '中文环境初始化脚本' and instruct it to be run for the session, while the final status message also directs the user to follow a specific Chinese/ZeroToken workflow. This is a natural-language locale policy issue because the file imposes a language-specific environment expectation without offering a user choice or opt-in.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The module docstring and all user-facing examples and status text are written in Chinese, and the tool's interface is described as producing Chinese output by default. This creates a language/locale constraint without offering user opt-in or documenting a justified region-specific requirement, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The function docstrings, argparse help strings, verification labels, and printed status messages are all hard-coded in Chinese, including success/failure summaries and CLI help text. Because there is no mechanism for language choice or opt-in, the script enforces a specific language for all users.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd = [sys.executable, os.path.join(SCRIPTS_DIR, script), *args]
    if not capture:
        try:
            return subprocess.run(cmd, cwd=REPO_ROOT).returncode, ''
        except OSError as exc:
            safe_print(f'[zt] 无法执行 {script}: {exc}')
            return 3, ''
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
return 3, ''

    try:
        proc = subprocess.run(cmd, cwd=REPO_ROOT, stdout=subprocess.PIPE,
                              stderr=subprocess.STDOUT)
    except OSError as exc:
        return 3, f'无法执行 {script}: {exc}'
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Scope Creep

Low
Category
Excessive Agency
Content
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low
Category
Excessive Agency
Content
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
All operational instructions and warnings are presented only in Chinese, and the file does not indicate that language selection is optional or user-driven. That can be a natural-language policy issue if the skill effectively forces a specific language without opt-in.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The module docstring, usage guidance, and safety notes are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy for this audit flags language-forcing behavior when the skill does not offer a language or locale choice.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
The module docstring and CLI help/output strings are presented exclusively in Chinese, which effectively forces a language choice on users. Under the policy, language constraints should either be optional, user-selectable, or clearly justified as region-specific.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The natural-language text in the module docstring specifies behavior and test expectations entirely in Chinese, and additional inline comments continue that pattern. For a general-purpose test script, this imposes a specific language/locale without any opt-in or justification, which matches the language-policy concern for natural-language content in code files.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The module docstring and embedded sample content are written in Chinese, including the skill name and expected audit messages, with no indication that language selection is optional or region-specific. This can conflict with language/locale policy if the skill is expected to be usable without forcing a specific language.

Static analysis

No suspicious patterns detected.