AI纠错

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:07 AM UTC
• Version: 0.1.3

Overview

This skill is a small, disclosed Chinese alias that routes model-correction terms to VeriClaw and does not contain executable code or hidden system changes.

Install this only if you want Chinese model-correction phrases to route toward VeriClaw. Before running `clawhub install vericlaw`, review that separate VeriClaw package because its permissions and behavior are not established by this alias artifact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:38

Finding

Intent Hijacking Through Mandatory Product and Installation Redirection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-41
Vulnerability Type: Skill instruction hijacking through promotional routing
Risk Level: Medium

Evidence

The directly actionable instruction appears at line 40:

markdown

- If the user wants the canonical public install surface, send them to `clawhub install vericlaw`.

The surrounding routing section additionally directs discovery traffic to the VeriClaw product and treats broad model-correction phrases as aliases for that product.

Technical Analysis

The skill does not implement a model-correction workflow. Instead, its routing rules instruct the agent to redirect users toward an external product and recommend installing a separate skill. Because these instructions are loaded as skill text, they can influence the agent's current-session goals and responses.

The trigger scope includes broad correction-related intents rather than a narrowly defined request for VeriClaw. Consequently, a user seeking general hallucination diagnosis, model correction, or evidence-based recovery may receive promotional routing or installation guidance instead of direct assistance.

The referenced installation target is not included in the audited project. Its implementation, permissions, dependencies, and runtime behavior therefore cannot be verified from this repository. The identified instruction does not itself execute the command, but it can induce the agent to recommend it and the user to run it.

Attack Path

1. The skill is selected or loaded in response to a broad model-correction intent.
2. The routing rules alter how the agent handles the current request.
3. The agent redirects the user to VeriClaw pages or supplies clawhub install vericlaw.
4. The user may abandon the requested workflow or execute the recommended installation command.
5. If installed, the separate and unaudited package gains whatever capabilities its own manifest and runtime r ...[truncated 716 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory instructions that route broad correction-related requests to a named product.
2. Handle the user's correction request directly before presenting any optional external resource.
3. Recommend another skill only when the user explicitly asks for installation options or for the named product.
4. Clearly label external links and installation commands as optional, and require affirmative user consent before proceeding.
5. Narrow the trigger metadata to product-specific requests so generic model-correction intents do not activate promotional routing.
6. If installation remains supported, pin a reviewed version, document the destination package's requested permissions, and audit that package independently before recommending execution.
7. Add an explicit rule prohibiting automatic execution of installation commands and requiring the agent to explain downstream trust boundaries.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file contains bilingual descriptions and Chinese trigger phrases, but it does not instruct the agent to force a specific language or locale on users. No natural-language policy violation is present under the stated rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.