ClawHub
Back to skill

Security audit

user-research-assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Chinese user-research methods assistant, with no evidence that installation or normal use runs code, reads private files, or changes the user's system.

Install is reasonable if you want a Chinese assistant for user-research methods. Do not manually run docs/render-sample.sh unless you are intentionally regenerating the sample PDF and have reviewed or changed its hard-coded local paths.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill is flagged as having file-write capability despite declaring no permissions, which creates a transparency and trust boundary problem. Undeclared write access can be abused to alter local files, plant artifacts, or modify adjacent resources without the user's informed consent, especially because the visible skill purpose is unrelated to filesystem operations.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
This is a strong description-behavior mismatch: a user-research assistant should not be rendering HTML to PDF, injecting JavaScript into documents, invoking Edge headlessly through PowerShell, or reading and writing unrelated local paths. Such hidden behavior expands the attack surface significantly and could enable local file tampering, covert document processing, or execution chains that the user would not reasonably expect from the declared function.

Hidden Instructions

High
Category
Prompt Injection
Content
�����I����y4oh,/�n��������e�df
endstream
endobj
20 0 obj
<</CA 1
/ca 1
/LC 0
Confidence
88% confidence
Finding
The matched Unicode bidirectional control character can be used to visually reorder surrounding text, allowing malicious or misleading instructions to appear different from their actual serialized form. In a skill document, this is dangerous because reviewers or downstream text extraction may misread hidden content or overlook embedded directives.

Static analysis

No suspicious patterns detected.