ClawHub
Back to skill

Security audit

truetime-cn

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese time and calendar utility with no evidence of network exfiltration, persistence, or hidden privileged behavior.

Install this if you want a Chinese-focused local time/calendar helper. Be aware it strongly encourages agents to run its Python script for many time-related questions and its responses are Chinese-oriented by default; it should not need network access, credentials, or background permissions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The description presents a broad, precise time-processing skill for dynamic time-sensitive decisions, including 'now', offsets, timezone/DST handling, and Chinese holiday/workday knowledge. However, this code chunk only shows a vendor config file containing static Chinese lunar/almanac datasets and constants. It does support part of the declared scope indirectly—especially lunar calendar metadata, heavenly stems/earthly branches, and 24 solar terms data—but there is no evidence here of the core dynamic time-processing behaviors emphasized in the description. Because the primary declared purpose is much broader and operationally different from what this chunk actually does, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a full-featured time engine for dynamic date/time reasoning, including 'now', tomorrow/X days later, timezone and DST correctness, lunar/sexagenary support, Chinese legal holidays with adjusted workdays, and 24 solar terms. The supplied code chunk, however, is only a static constants module containing holiday name mappings: a few legal solar holidays, a few legal lunar holidays, and extensive lists of commemorative/religious observances by month/day. There is no executable logic for obtaining the current time, advancing conversation time, parsing relative dates, handling time zones or DST, performing date arithmetic, or computing holiday schedules and make-up workdays. While the data may support a broader calendar library, this chunk alone materially underdelivers on the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a broad time-processing skill centered on factual time utilities: 'now', tomorrow/X days later, deadlines, meetings, timezone/DST correctness, and Chinese holiday handling, with lunar/solar-term support as part of that. The supplied code chunk, however, is specifically a cnlunar lunar/almanac implementation. It does support some declared subareas: lunar calendar conversion, Ganzhi/eight characters, Chinese holidays, and 24 solar terms. But its primary behavior in this chunk is much narrower and materially different from the description's core promise of precise time computation for scheduling. There is no evidence here of current-time acquisition, timezone handling, DST logic, relative/absolute offset parsing, or meeting/deadline calculations. Conversely, a major portion of the code computes traditional 黄历/宜忌,吉凶神煞, zodiac clashes, lucky directions, etc., which is a substantial undeclared capability and not implied by the scheduling/time-precision description. Therefore the description does not accurately represent this code chunk's actual primary behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description presents a broad, production-facing time reasoning skill. The supplied code, however, is a narrow internal utility module for decoding/encoding stored 24节气 data and fetching yearly solar-term lists. It does not compute current time, date arithmetic, time zones, DST, holidays, or planning-related functions. While 24 solar terms are mentioned in the description, this chunk only supports that single sub-area and even there only at the data unpacking level. Therefore the code chunk does not accurately represent the declared overall behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises a comprehensive time-processing skill. However, the supplied code chunk is a generic utility module (tools.py) with basic helper functions for list manipulation, string emptiness checks, vector-style list merging, and custom sorting via imported configuration. None of the visible functions access clocks, parse dates, compute offsets, handle time zones/DST, or implement Chinese calendar/holiday/solar-term logic. While such helpers could support a larger calendar library, this chunk by itself does not substantiate the declared primary purpose, so the description does not accurately represent the behavior of the supplied code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description says this is a Chinese time-processing skill and frames its functionality entirely around Chinese output and handling, without indicating that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The name/description and multiple sections present the skill as “中文优先” and define outputs such as Chinese summaries and lunar display fields, but there is no indication that users may choose another language. This can violate language or locale policy when the skill is invoked for users who did not opt into Chinese-first behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The blanket instruction to use the skill for 'any' time-sensitive decision is insufficiently constrained and can pressure the agent to invoke the tool even when the request does not need it. This broad mandate can be abused by adversarial prompts to trigger unnecessary code execution paths and reduce the model's discretion to minimize tool use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger guidance is intentionally broad enough to activate on many ordinary mentions of time, which can cause unnecessary tool execution and over-collection of contextual user data for benign queries. In agent settings, overbroad automatic activation increases attack surface and can let prompt-crafted inputs steer the system into invoking code/tools more often than necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code and its natural-language assertions consistently require Chinese output, including Chinese error text and localized holiday/lunar strings. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy violation unless the locale restriction is clearly documented and justified; this test file does not provide that justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This file stores all holiday and observance names exclusively in Chinese string literals across the dataset. Because SQP-3 applies to all file types and covers language or locale policy violations, a fixed single-language output without an explicit user choice or documented locale constraint is a policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 7)May include surrounding context.

python
# base code by Yovey , https://www.jianshu.com/p/8dc0d7ba2c2a
# powered by Late Lee, http://www.latelee.org/python/python-yangli-to-nongli.html#comment-78
# other author:Chen Jian, http://www.cnblogs.com/chjbbs/p/5704326.html
# 数据来源: http://data.weather.gov.hk/gts/time/conversion1_text_c.htm


from datetime import datetime, timedelta

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This Python file hard-codes Chinese-language labels and output tokens such as season names, zodiac/day strings, and later methods return Chinese text directly. Because the file provides no opt-in, fallback, or locale selection, it effectively forces a specific language, which matches the language/locale policy-violation category.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 361)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 367)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 370)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 371)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 372)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 427)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/lunar.py (reported line 435)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/solar24.py (reported line 21)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/solar24.py (reported line 24)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · vendor/cnlunar/solar24.py (reported line 27)May include surrounding context.

python
return abListMerge(list2)
# 采集压缩用
def zipSolarTermsList(inputList,charCountLen=2):
    tempList=abListMerge(inputList, type=-1)
    data=0
    num=0
    for i in tempList:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code file contains natural-language strings stating the tool is '中文优先' and later describes it as Chinese-oriented by default. Under the language/locale policy, forcing or defaulting to a specific language without user opt-in can be a policy concern when no alternative language option is offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.