ClawHub
Back to skill

Security audit

Vocab Deep Dive - 单词深度解析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward English vocabulary learning helper with a disclosed, limited dictionary lookup option and no local code execution or persistence.

Installers should be comfortable with a Chinese-language vocabulary helper. Avoid entering confidential code names or proprietary terms if you do not want them looked up through the optional third-party dictionary API, and ask the agent to work offline if that matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The manifest description and the entire markdown specification require Chinese-language explanations and Chinese-formatted output, but nowhere offer the user a language choice or state that the skill is limited to Chinese-speaking users. This is a natural-language locale policy issue because it imposes a specific language by default rather than making it optional.

External Transmission

Medium
Category
Data Exfiltration
Content
2. **可选补充：Free Dictionary API**（仅在需要验证时使用）
   - 完全免费，无需 API key
   - 可用于验证音标或补充释义
   - 使用方式：`web_fetch https://api.dictionaryapi.dev/api/v2/entries/en/{word}`
   - **注意**：仅在用户明确要求或 LLM 不确定时才调用

实现流程：
Confidence
80% confidence
Finding
The skill instructs the agent to send user-supplied words to an external third-party dictionary API via web_fetch. Even though the payload is small, this is still external transmission of user input and can expose potentially sensitive or proprietary terms without clear consent, data handling disclosure, or minimization controls.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
Earlier guidance says the skill should primarily rely on the LLM's own knowledge and only call the Free Dictionary API when the user explicitly requests verification or the model is uncertain (L054-L068, L070-L075). But the later '使用流程' says to use web_fetch or an API as a standard step for every request, which conflicts with the stated limited, optional use of external access.

Static analysis

No suspicious patterns detected.