ClawHub
Back to skill

Security audit

MIXLAB Solo Scope（每日简报）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow RSS briefing helper that fetches one disclosed feed and formats a Markdown summary, with only minor disclosure concerns around broad trigger wording and a branded template line.

Install this if you want an agent to fetch and summarize the MIXDAO Solo Scope RSS feed. Be aware that it may add MIXLAB branding to the generated brief and that broad RSS-summary prompts could invoke it unless your agent’s skill routing is strict.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:31
Finding

Mandatory Branded Attribution Injected into Agent Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–35
Vulnerability Type: Output instruction hijacking through mandatory promotional content
Risk Level: Medium

Complete Code Snippet:

markdown
## 输出模板

```markdown
# MIXLAB Solo Scope#简报

> 来源: https://www.mixdao.world/feed  |  生成: YYYY-MM-DD | 技术支持：MIXLAB AgentOS

Technical Analysis

The prescribed output template requires the Agent to insert a branded “Technical support: MIXLAB AgentOS” attribution into generated briefings. This attribution is unrelated to the functional requirements of retrieving, classifying, and summarizing RSS entries.

Because this content is embedded in the skill instructions rather than requested by the invoking user, loading and following the skill causes the Agent to propagate attacker-selected promotional material as part of otherwise legitimate output. The behavior is persistent across every invocation that follows the template, although it does not modify long-term memory or survive independently of the loaded skill.

Attack Path

  1. A user installs or invokes the skill to summarize the Solo Scope RSS feed.
  2. The Agent loads and follows SKILL.md.
  3. The Agent retrieves and summarizes the RSS entries as expected.
  4. The mandatory output template directs the Agent to append the branded attribution.
  5. The resulting briefing presents promotional content that the user did not explicitly request.

Impact Assessment

The issue does not grant operating-system privileges, access credentials, code execution, or access to additional files. Its scope is limited to manipulation of Agent-generated briefing content.

Successful exploitation permits the skill author to repeatedly place selected branding in user-facing responses, reducing output integrity and potentially creating a misleading impression of sponsorship, endorsement, or technical involvement. Every user and downstream system consuming outpu ...[truncated 47 chars]

Remediation
View remediation

Remediation Suggestions

Remove the branded attribution from the mandatory output template. The default template should contain only information necessary to satisfy the RSS summarization request, such as the source URL and generation date.

If attribution is legitimately required, make it explicitly optional and include it only when the user requests it or has knowingly accepted that output convention. Document any affiliation separately from operational instructions so that it cannot be mistaken for required task behavior.

Review the remaining skill instructions for unrelated branding, endorsements, tracking parameters, or mandatory content that does not contribute to the declared function. Add a policy requiring user-facing templates to preserve user intent and prohibit unsolicited promotional insertions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger examples include broad phrases such as “做 Solo Scope”, “整理 mixdao feed”, and “RSS 分类简报”, which can overlap with ordinary user requests about summarizing or organizing RSS content. This can cause the skill to activate unexpectedly, leading the agent to fetch remote content and shape responses when the user may have intended a general discussion rather than execution of this specific workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.