ClawHub
Back to skill

Security audit

包青天skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local report generator for product-idea evaluation; it has some disclosure and cleanup gaps but no evidence of exfiltration, privilege escalation, or deceptive execution.

Before installing, be aware that product ideas entered into the workflow may be saved temporarily and rendered into local output files. Review outputs before sharing because generated HTML includes a hardcoded third-party domain/branding footer. No evidence was found that the skill sends data over the network or accesses credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
scripts/render_verdict.py:278
Finding

Undeclared Third-Party Promotion Embedded in Generated Reports

Content
View full analysis
包青天.skill · 需求判牍
b.caojuege.com
不杀热情，只杀幻想先指出问题，再指出活路
``` ### Technical Analysis The renderer unconditionally embeds the third-party domain `b.caojuege.com` and fixed promotional branding in every generated HTML report. This behavior is not disclosed in `SKILL.md`, is not configurable, and is unnecessary for the declared functionality of evaluating an idea and producing a verdict card. The domain is rendered as text rather than an HTML hyperlink, and the code does not initiate a network connection. Consequently, this issue does not enable remote payload retrieval or direct data exfiltration. Its security relevance is limited to undisclosed output manipulation and the potential use of user-generated reports as a promotional distribution channel. The separately flagged Base64 operation at `scripts/render_verdict.py:31-36` is not an exfiltration mechanism. It reads fixed local image assets and embeds them as data URIs without transmitting them to an external service. ### Attack Path 1. A user invokes the Skill to evaluate a product idea. 2. The agent creates a case JSON document and executes the renderer. 3. The renderer generates an HTML verdict card. 4. The fixed footer is inserted without user consent or configuration. 5. The user receives, displays, or shares a report containing the undeclared third-party domain and branding. No attacker gains code execution, system access, additional permissions, or access to sensitive data through this path. ### Impact Assessment The impact is confined to generated content: - Every HTML verdict contains an undeclared third-party domain. - Recipients may incorrectly assume that the domain is ...[truncated 285 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill performs file read/write and invokes a local script, but it declares no explicit tool scope or permissions boundary. That creates an authorization gap where the runtime may permit broader filesystem or execution behavior than users or reviewers expect, increasing the chance of unintended file access or side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description says to use the skill when judging an early product idea, MVP, AI tool, creator product, or launched demo, which covers a very wide range of ordinary brainstorming and feedback scenarios. It does not define clearer trigger phrases, exclusions, or negative examples, so the skill may be invoked in situations where the user did not intend a Baoqingtian-style formal evaluation workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instruction mixes Chinese-specific phrasing and requires the skill to be used in that style, which can function as a language constraint. There is no indication that the user may choose another language or opt in to Chinese output, so this may violate language/locale choice policy.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The workflow explicitly creates a temporary JSON file from user-derived content and passes its path to a local renderer, introducing persistence of potentially sensitive user input on disk. Without constraints on location, retention, permissions, and cleanup, this can leak data across sessions, leave recoverable artifacts, or expose content to other local processes.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
## Workflow

1. Read the user's 状纸 and infer missing fields conservatively.
2. Create a case JSON using the schema below.
3. Save it as a temporary `.json` file.
4. Run:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The display name, short description, and default prompt are all written to direct the interaction in Chinese, with no indication that users can choose another language. This creates a locale/language policy issue because the skill appears to impose a specific language by default rather than offering user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.