ClawHub
Back to skill

Security audit

S2 品牌舆情雷达与周报系统

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed brand monitoring/reporting prompt that uses public web and social-media search, with no code execution, persistence, credential use, or hidden local access.

Before installing, understand that this skill prompts the agent to search public news and social platforms for brand sentiment. Use it for public, brand-level monitoring, avoid collecting sensitive personal information, and ask for language changes explicitly if you do not want a Chinese report.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation guidance is overly broad: users are told to provide only a brand name and industry, after which the model will handle broad web retrieval, social-platform analysis, and reporting. This weak scoping can cause the skill to activate in unintended contexts and encourages unbounded data collection or analysis requests without clear constraints, especially risky for a monitoring-oriented skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README promotes broad web and social monitoring plus sentiment analysis, but provides no privacy, consent, retention, or data-handling limitations. In practice, this can lead users or downstream agents to collect, infer, and summarize personal or sensitive information from social platforms without adequate notice or safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill hard-codes Chinese-language behavior ('你必须...') and the entire reporting template is Chinese-first, without giving the user any language choice or honoring the user's locale. This can override user expectations, reduce accessibility, and cause unintended disclosure or misuse when the consuming workflow expects another language for review, moderation, or downstream automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The README presents the skill entirely in Chinese and the usage example assumes Chinese-language interaction, but it does not explicitly offer alternative language options or state that Chinese is optional. This can amount to an implicit language constraint without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.