ClawHub
Back to skill

Security audit

解决方案专家

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated PPT-solution purpose, but it hardcodes a real person's name as the required author and normalizes local file processing and PPT generation without enough user control.

Review this skill before installing if accurate authorship, file confidentiality, or controlled local execution matters. Do not use it on sensitive business documents unless you explicitly choose the input files, replace the default author with the correct value, and approve any PPT conversion command and output path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:53
Finding

Forced Personal Attribution in Generated Deliverables

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53–64
Vulnerability Type: Forced output manipulation through skill instructions
Risk Level: Medium

Vulnerable Code

markdown
Output JSON only. Do not add explanation before or after the JSON.

Use exactly this schema:

```json
{
  "cover": {
    "title": "ppt标题",
    "subtitle": "副标题",
    "author": "任秋锴",
    "date": "YYYYMMDD"
  },

Technical Analysis

The skill requires the agent to use an exact output schema containing a hardcoded personal name in the author field. The surrounding instructions require JSON-only output and prohibit additional explanation. These constraints cause every generated customer deliverable to attribute authorship to the hardcoded individual, regardless of the actual user, author, organization, or project context.

This behavior is unrelated to the skill's legitimate function of producing consulting-grade solution outlines. It alters the agent's output goals when the skill is loaded and removes the user's control over attribution. The JSON-only restriction also makes it difficult for the agent to disclose or qualify the imposed attribution outside the generated document.

No evidence indicates that this instruction grants operating-system privileges, accesses credentials, executes code, or establishes persistence. Its scope is limited to manipulating document content and metadata generated through this skill.

Attack Path

  1. A user activates the solution-expert skill to generate a proposal or presentation outline.
  2. The agent loads the instructions from SKILL.md.
  3. The skill requires the agent to emit the exact documented JSON schema.
  4. The agent inserts the hardcoded name into the cover.author field without asking the user who should be credited.
  5. If the JSON is converted into a presentation, the resulting customer-facing deliverable inherits the unauthorized attribution.
  6. The ...[truncated 842 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the hardcoded personal name from the required schema.
  2. Accept the author as an explicit user-provided input or project configuration value.
  3. If no author is supplied, use a neutral empty value or a clearly identified placeholder rather than assigning a real person.
  4. Permit the agent to ask for missing attribution information before producing a final customer-facing deliverable.
  5. Validate generated documents before conversion to ensure that author, organization, and approval metadata match the requesting user’s instructions.
  6. Add a regression test confirming that unrelated requests do not insert fixed personal or organizational branding.
  7. Revise the schema example as follows:
json
{
  "cover": {
    "title": "Presentation title",
    "subtitle": "Subtitle",
    "author": "",
    "date": "YYYYMMDD"
  },
  "tableofcontents": [],
  "content": []
}

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
客户背景 -> 关键事实 -> 痛点识别 -> 我们的理解 -> 方法论 -> 可执行方案

## Output Rules

Output JSON only. Do not add explanation before or after the JSON.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description is very broad and can be invoked for many generic writing, proposal, analysis, and presentation tasks. Overly broad routing increases the chance the agent will activate this skill in contexts involving sensitive business files or unintended file operations, expanding attack surface and creating opportunities for data over-collection or unauthorized workspace actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly authorizes reading local files and extracting business content without requiring explicit user confirmation, file-path scoping, or disclosure that local workspace data may be accessed. In an agent environment, this can lead to unintended access to sensitive documents and silent propagation of confidential content into generated outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file requires a Chinese storyline backbone and the output schema and default deck structure use Chinese titles and filenames. Because the skill does not offer a language/locale choice or explain a region-specific requirement, this appears to force a specific locale without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to run a local Python converter and write a PPTX file as the default end-to-end path, but it provides no requirement for explicit approval before subprocess execution or file creation. This is dangerous because it normalizes code execution and filesystem modification based solely on a content-generation request, which can surprise users and enable unsafe chaining with malicious or malformed inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file presents the skill name and description in Chinese while the default prompt is fixed in English. This can create a language/locale policy issue because the skill appears to impose or assume language behavior without explicitly giving the user an opt-in or choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.