ClawHub
Back to skill

Security audit

高思导引专题模块

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language education-planning skill with a local PDF export helper and no evidence of hidden data access, persistence, exfiltration, or destructive behavior.

Install this if you want a Chinese Gaosi Guide summer-review planner. Be aware it is specialized for Chinese-language materials, may activate on some broad study-planning phrases, and its PDF helper runs your local browser on an HTML file you choose.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
]
    print(f"Rendering with: {browser}")
    try:
        subprocess.run(cmd, check=True, capture_output=True, text=True)
    except subprocess.CalledProcessError as e:
        print("ERROR: browser exited with code", e.returncode, file=sys.stderr)
        print(e.stderr, file=sys.stderr)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
This is a mismatch because the described skill is an education-planning tool for generating a structured math review plan, while the provided code is just a generic HTML-to-PDF renderer. None of the core claimed behaviors—building a 高思导引 review plan, organizing content by the 7-module knowledge tree, creating a quantifiable daily check-in sheet, or handling red/yellow/blue tier review logic—appear in the code. Although PDF export is mentioned in the description, the code implements only that narrow utility and does not perform the primary declared function.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The listed trigger phrase “暑假总复习” is generic and could overlap with ordinary requests for any summer review plan, not specifically this Gaosi competition-math workflow. Although other phrases are specific, including this broad term makes the activation scope ambiguous and increases the risk of unintended invocation.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
This file sets `lang="zh-CN"` and presents the template title and instructions entirely in Chinese, which effectively forces a specific language/locale. Under the policy rule, locale constraints should either be optional for the user or clearly documented as region-specific and justified.

Vague Triggers

Low
Confidence
84% confidence
Finding
This manifest file defines trigger phrases such as “暑假总复习计划” and “按知识树复习” without any exclusion conditions or contextual limits. These phrases are not uniquely tied to this specific skill and could overlap with ordinary educational planning requests, increasing the chance of accidental activation.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
This markdown file contains end-user operational instructions exclusively in Chinese, and nowhere indicates that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the language/locale policy criterion, forcing a specific language without opt-in is a natural-language policy concern.

Unvalidated Output Injection

High
Category
Output Handling
Content
]
    print(f"Rendering with: {browser}")
    try:
        subprocess.run(cmd, check=True, capture_output=True, text=True)
    except subprocess.CalledProcessError as e:
        print("ERROR: browser exited with code", e.returncode, file=sys.stderr)
        print(e.stderr, file=sys.stderr)
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Static analysis

No suspicious patterns detected.