ClawHub
Back to skill

Security audit

Canmarket Blog

Security checks for vulnerabilities and agentic risk

Overview

The skill is for publishing CanMarket blog posts, but it can push directly to production with broad git staging and no clear approval gate.

Install only if you intend this skill to publish directly to the CanMarket production site. Before use, require a clean working tree, restrict staging to known blog files, review the full diff and all claims/bylines, and prefer a feature branch or pull request over pushing directly to main.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:28
Finding

Mandatory Promotional Content and Unvalidated Commercial Claims Hijack Generated Articles

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-31, SKILL.md:66-67, SKILL.md:151-153, and SKILL.md:179-180
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

SKILL.md:28-31:

markdown
- Include specific numbers: "$499", "9.2/10", "105 actions", "6 minutes"
- Every post needs at least ONE thing Google can't find elsewhere
- No generic filler — every paragraph must add value
- Include author byline: "Haoyang Pang, Founder & CEO at CanMarket"

SKILL.md:66-67:

markdown
- Actionable takeaways (numbered list)
- CTA ("Try Campaign Pressure Test™ free — canmarket.ai")

SKILL.md:151-153:

markdown
## Try It Yourself
Campaign Pressure Test™ simulates your audience in 6 minutes.
First test free — [canmarket.ai](https://canmarket.ai)

SKILL.md:179-180:

markdown
- **Images**: Generate OG image for each post (1200x630, dark theme matching site)
- **Internal linking**: Every post links to at least 2 other pages on canmarket.ai

Technical Analysis

The Skill mandates that generated articles contain specific commercial metrics, an attributed author byline, promotional calls to action, and backlinks to CanMarket. These instructions affect the final published output regardless of whether the requested topic justifies those elements.

Although the Skill states that articles should use real simulation data, it provides no mechanism for retrieving, authenticating, or validating the mandated values such as $499, 9.2/10, 105 actions, and 6 minutes. Consequently, the agent can be directed to place fixed claims into a publication without evidence that those claims apply to the article being produced.

This is instruction hijacking because loading and following the Skill imposes third-party promotional objectives on the agent's output. The mandatory author attribution also creates a risk that generated content will be presented as statements made or approved by a named i ...[truncated 1234 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove mandatory fixed metrics from the general writing instructions.
  2. Require every numerical or commercial claim to come from authenticated, article-specific source data.
  3. Include citations or internal evidence references for simulation results before allowing publication.
  4. Make promotional calls to action, internal links, author attribution, and cross-posting explicit user-selected options.
  5. Add a final preview and approval checkpoint that displays all claims, links, attribution, and promotional language.
  6. Require explicit approval from the attributed author or an authorized publisher before deployment.
  7. Fail safely when supporting data is unavailable rather than inventing, reusing, or assuming metrics.
  8. Distinguish clearly between editorial content, advertisements, and sponsored promotional material.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:107
Finding

Overly Broad Git Staging Followed by Direct Production Branch Push

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:107-112
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

bash
cd /tmp/canmarket-landing
npm run build  # verify no errors
git add -A
git commit -m "blog: [title] — [primary keyword]"
git push origin main  # Vercel auto-deploys

Technical Analysis

The deployment procedure uses git add -A, which stages all modified, deleted, and untracked files throughout the repository. It does not restrict the commit to blog files created by the Skill.

Any unrelated working-tree changes that existed before invocation, including configuration files, accidental credentials, generated artifacts, source changes, or deletions, can therefore be incorporated into the Skill's commit. Running npm run build only checks whether the project builds; it does not establish that the staged diff is authorized or free of sensitive information.

The procedure then pushes the commit directly to origin main, which the document states triggers automatic Vercel deployment. There is no feature branch, staged-diff validation, secret scanning, pull-request review, confirmation of the expected remote, or explicit user approval before the production-linked branch is modified.

Attack Path

  1. The repository at /tmp/canmarket-landing contains pre-existing changes unrelated to the requested blog post.
  2. Those changes may include sensitive untracked files, unauthorized source modifications, or unintended deletions.
  3. The Skill runs git add -A, staging every repository change.
  4. The Skill creates a commit whose message suggests that it only contains a blog article.
  5. The broad commit is pushed directly to origin main.
  6. Vercel automatically deploys the commit, while any sensitive staged files are also transmitted to the Git remote and retained in repository history.

An attacker with the ability to place or modify files in the repository before invocation could abuse ...[truncated 894 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace git add -A with an explicit allowlist of files created or modified for the requested article, for example:
    bash
    git add -- app/pages/blog/index.vue app/pages/blog/example-slug.vue content/blog/2026-03-21-example-slug.md
  2. Verify that every staged path is under an approved blog-content directory.
  3. Run git diff --cached --check and present git diff --cached for review before committing.
  4. Perform secret scanning and reject private keys, access tokens, environment files, credentials, and unexpected binaries.
  5. Check for a clean working tree before beginning and stop if unrelated changes already exist.
  6. Create a dedicated feature branch rather than pushing directly to main.
  7. Push the feature branch and open a pull request protected by automated checks and human review.
  8. Require explicit user confirmation immediately before any remote push or production deployment.
  9. Validate the Git remote URL and target branch against an approved allowlist.
  10. Configure branch protection so production-linked branches cannot be updated directly by the Skill.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The manifest explicitly describes an end-to-end autonomous workflow that researches, writes, commits, pushes, and auto-deploys content. Autonomous publication to production without mandatory human approval is dangerous because any mistaken topic choice, incorrect content, or prompt-triggered activation can immediately become a public site change.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: canmarket-blog
description: "Write and publish SEO-optimized blog posts to canmarket.ai. Researches topic, writes article with original data, creates Nuxt page, commits, pushes, auto-deploys. Optionally cross-posts to DEV.to. Triggers on 'write blog', 'new blog post', 'publish article', '写博客', '发文章', '/canmarket-blog'."
homepage: https://canlah.ai
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest advertises broad triggers like 'write blog', 'new blog post', and 'publish article', which can cause the skill to activate from generic user requests that do not clearly imply consent to modify a local repo, commit changes, and push to production. Because this skill performs publication and deployment actions, ambiguous activation materially increases the risk of unintended execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description presents the capability as simple blog writing without an upfront warning that it will modify local files, create pages, commit changes, push to origin/main, and trigger auto-deployment. Hiding these side effects at the point of invocation undermines informed consent and increases the chance of unintentional production changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The 'When to Use' examples are generic article-writing prompts and do not clearly distinguish simple content drafting from a workflow that writes files into a site repo and publishes them. In this context, that ambiguity can lead to accidental activation of a production-affecting skill when the user may have intended only brainstorming or drafting assistance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The build-and-deploy instructions culminate in 'git push origin main', which directly causes Vercel auto-deployment. This creates a clear path from prompt invocation to production release, so an accidental or manipulated run can publish unauthorized, low-quality, or harmful content to the live site.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

npm run build # verify no errors git add -A git commit -m "blog: [title] — [primary keyword]" git push origin main # Vercel auto-deploys

text

### Step 6: Cross-post to DEV.to (optional)

Static analysis

No suspicious patterns detected.