ClawHub
Back to skill

Security audit

ZeroToken

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed token-saving and encoding/workflow helper, with file and command utilities that match its stated purpose.

Install only if you want a concise-output workflow and the bundled file-encoding utilities. Be aware it may guide the agent to read or modify project files, run local helper scripts, write .zerotoken/environment.json, and adjust current-repository git quotepath on Windows; review commands before using conversion or repair modes on important files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · CHANGELOG.md (reported line 374)May include surrounding context.

md
### Changed
- Restructured SKILL.md: decision table at top, then core principles (5 from 8), then task modes with concrete tool mappings.
- Tightened all sections—removed redundancy across core principles, task modes, and output rules.
- Updated agents/openai.yaml default_prompt to match new decision-table-first flow.

## [1.0.3] - 2026-04-27

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/init_env.ps1 (reported line 1)May include surrounding context.

text
<#
.SYNOPSIS
    Windows/PowerShell + 中文环境初始化脚本
.DESCRIPTION

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file presents the skill's operational instructions primarily in Chinese, including required procedures and constraints, but does not state that the user may choose another language. That can violate a language/locale policy when users are implicitly forced into a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description is presented in Chinese and does not indicate that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file is written as a mandatory execution specification and states that any generated or modified code, configuration, or documentation must comply with it. Because the instructions are presented only in Chinese and framed as mandatory, this imposes a language/locale constraint without user opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation text says the skill triggers whenever a task needs external information, with examples spanning news, people, companies, social content, and real-time info. This scope is very broad and does not define clear boundaries or negative examples, so it could cause unintended invocation for many common user requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file title and all operational guidance are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file explicitly states the mode auto-enables on Windows/PowerShell and 'does not require the task to involve Chinese.' Combined with the document’s pervasive Chinese-language operating guidance, this imposes a language/locale-specific workflow automatically rather than offering user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and CLI descriptions are entirely in Chinese, including the stated output format and usage guidance. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale/language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and later guidance repeatedly assume Chinese output/support as a built-in requirement, such as persisting '中文支持能力' and tailoring workflow around Chinese text handling. This imposes a specific language/locale expectation rather than offering a user choice or documenting an explicit region-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/detect_env.py (reported line 74)May include surrounding context.

python
name = Path(exe).name.lower()
    info["edition"] = "powershell-core" if name.startswith("pwsh") else "windows-powershell"
    try:
        completed = subprocess.run(
            [exe, "-NoProfile", "-Command", "$PSVersionTable.PSVersion.ToString()"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/detect_env.py (reported line 173)May include surrounding context.

python
pass

        try:
            git_quotepath = subprocess.run(
                ["git", "config", "--get", "core.quotepath"],
                capture_output=True,
                text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The generated workflow text directs users to write and verify files 'with Chinese' and describes mode behavior around Chinese/CJK content as standard operating procedure. Because this natural-language guidance is emitted to users/agents without an opt-in or justified locale restriction, it conflicts with the policy against forcing a specific language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The synopsis and description explicitly frame the script as a '中文环境初始化脚本' and instruct it to be run for the session, while the final status message also directs the user to follow a specific Chinese/ZeroToken workflow. This is a natural-language locale policy issue because the file imposes a language-specific environment expectation without offering a user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring and all user-facing examples and status text are written in Chinese, and the tool's interface is described as producing Chinese output by default. This creates a language/locale constraint without offering user opt-in or documenting a justified region-specific requirement, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function docstrings, argparse help strings, verification labels, and printed status messages are all hard-coded in Chinese, including success/failure summaries and CLI help text. Because there is no mechanism for language choice or opt-in, the script enforces a specific language for all users.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/zt.py (reported line 99)May include surrounding context.

python
cmd = [sys.executable, os.path.join(SCRIPTS_DIR, script), *args]
    if not capture:
        try:
            return subprocess.run(cmd, cwd=REPO_ROOT).returncode, ''
        except OSError as exc:
            safe_print(f'[zt] 无法执行 {script}: {exc}')
            return 3, ''

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/zt.py (reported line 105)May include surrounding context.

python
return 3, ''

    try:
        proc = subprocess.run(cmd, cwd=REPO_ROOT, stdout=subprocess.PIPE,
                              stderr=subprocess.STDOUT)
    except OSError as exc:
        return 3, f'无法执行 {script}: {exc}'

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 594)May include surrounding context.

text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 606)May include surrounding context.

text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

All operational instructions and warnings are presented only in Chinese, and the file does not indicate that language selection is optional or user-driven. That can be a natural-language policy issue if the skill effectively forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring, usage guidance, and safety notes are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy for this audit flags language-forcing behavior when the skill does not offer a language or locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring and CLI help/output strings are presented exclusively in Chinese, which effectively forces a language choice on users. Under the policy, language constraints should either be optional, user-selectable, or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language text in the module docstring specifies behavior and test expectations entirely in Chinese, and additional inline comments continue that pattern. For a general-purpose test script, this imposes a specific language/locale without any opt-in or justification, which matches the language-policy concern for natural-language content in code files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring and embedded sample content are written in Chinese, including the skill name and expected audit messages, with no indication that language selection is optional or region-specific. This can conflict with language/locale policy if the skill is expected to be usable without forcing a specific language.

Content

No source excerpt is available for this finding.