ClawHub
Back to skill

Security audit

geo-optimization-cn

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language business marketing content helper whose risky behaviors are mostly disclosed and purpose-aligned, though users should be careful with document privacy and dependency execution.

Install only if you are comfortable with a Chinese-language marketing workflow that reads user-selected Word documents and asks you to copy extracted content into Claude. Avoid using confidential, regulated, or personal data unless your Claude environment and retention settings are appropriate. Pin and review dependencies, prefer running document conversion in a sandbox, and manually review generated marketing content before publishing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
scripts/business_content_generator.py:468
Finding

Untrusted Document Content Is Embedded Directly into AI Prompts

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/business_content_generator.py:310
Finding

Runtime Resolution and Execution of Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The Chinese description claims multiple content-generation and document-conversion capabilities that static analysis indicates are not implemented, and the code reportedly performs a different conversion direction than advertised. Such mismatch can mislead operators into trusting outputs, misrouting sensitive files, or invoking workflows that do not provide the expected safeguards or review points.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The Chinese description claims multiple content-generation and document-conversion capabilities that static analysis indicates are not implemented, and the code reportedly performs a different conversion direction than advertised. Such mismatch can mislead operators into trusting outputs, misrouting sensitive files, or invoking workflows that do not provide the expected safeguards or review points.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/business_content_generator.py (reported line 503)May include surrounding context.

python
- 直接从第一个问题开始输出
- 每个QA之间用"---"分隔
"""
    return prompt

def generate_extract_prompt(content):
    """生成企业信息提取的AI提示词"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/business_content_generator.py (reported line 639)May include surrounding context.

python
- 直接从第一个问题开始输出
- 每个QA之间用"---"分隔
"""
    return prompt

def generate_extract_prompt(content):
    """生成企业信息提取的AI提示词"""

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire skill description and usage documentation are presented only in Chinese, with no indication that users may choose another language or locale. Under the policy for natural-language violations, a skill that forces a specific language without user opt-in should be flagged unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill documents shell and file-processing behavior but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to overbroad execution authority, making accidental or unsafe file access and command execution more likely than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill name/description, commands, examples, outputs, and documentation are entirely oriented to Chinese-language business content generation, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill encourages processing Word documents containing company information but does not warn that those files may include sensitive business or personal data that will be handled by AI tooling. This omission increases the risk of unintentional disclosure, especially when users may not realize documents, extracted text, or prompts could leave the local context or be exposed to additional tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains its primary description and user-facing text entirely in Chinese, and the CLI later continues that same fixed-language behavior. That creates a language/locale policy concern because the skill implicitly forces one language without documenting a justified regional scope or giving users a choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

The script invokes an external tool via subprocess using a user-influenced file path. Although it avoids shell=True, it still executes a dependency-resolving command (uvx --with markitdown[docx]) that may fetch or run external packages and processes untrusted document input, expanding the attack surface to parser exploits, malicious files, or unexpected executable resolution in the environment. In a skill context that processes attacker-supplied Word files, this is materially risky.

Content

Scanner excerpt · scripts/business_content_generator.py (reported line 314)May include surrounding context.

python
def read_word_document(file_path):
    """读取Word文档内容"""
    try:
        result = subprocess.run(
            ["uvx", "--with", "markitdown[docx]", "markitdown", file_path],
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Manifest 明确声明“从Word文档提取企业6大关键信息”，但代码中的提取提示词实际要求输出七个编号章节，外加“附录：联系信息”。这不是实现细节差异，而是功能范围明显扩大，导致技能声明与实际行为不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The command descriptions, help text, and runtime instructions shown to users are all fixed in Chinese. Because the file does not offer locale selection or an explicit Chinese-only scope, this is a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s natural-language description and implementation are explicitly tied to Chinese output, including Chinese-only usage text and hardcoded Chinese font selection. Because the script does not provide a language or locale opt-in and the file does not justify a region-specific constraint, this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill name, description, and parameter descriptions are entirely in Chinese, and the command interface is documented only for Chinese-speaking users. This creates a language/locale constraint without offering a user choice or explaining that the skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese, which can amount to a language policy issue when no opt-in or alternative locale is provided. The document does not state that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.