ClawHub
Back to skill

Security audit

Cuihua Config Validator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local config validator, but it encourages checking sensitive .env files without safeguards and its advertised capabilities exceed the bundled implementation.

Review this before installing if you expected full AI/YAML/best-practice validation. Do not point it at unredacted .env or credential-bearing configuration files unless you are comfortable with the agent reading those contents locally; prefer redacted samples for troubleshooting secrets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill advertises AI-powered JSON/YAML validation, conflict detection, and best-practice guidance, but the analysis indicates it only performs basic JSON parsing and undeclared local file reads. This mismatch can mislead users into exposing sensitive configuration files under false assumptions about capability and safety, especially when .env or other secret-bearing files are involved.

Credential Access

High
Category
Privilege Escalation
Content
## Quick Start
> "Validate package.json"
> "Check .env file"

## Install
\`\`\`bash
Confidence
88% confidence
Finding
Encouraging users to 'Check .env file' directly targets a file type that often contains API keys, passwords, and tokens. In the context of a skill with undeclared file-reading behavior, this creates a credible risk of credential exposure through collection, logging, or downstream processing.

Credential Access

High
Category
Privilege Escalation
Content
## Supported Formats
- package.json
- tsconfig.json
- .env files
- docker-compose.yml
- Custom JSON/YAML
Confidence
83% confidence
Finding
Listing '.env files' as a supported format is not inherently malicious, but in this context it normalizes analysis of credential-bearing files without accompanying safeguards or warnings. That increases the probability of users exposing secrets to the skill during routine use.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill promotes checking environment variable files without warning that such files commonly contain secrets, tokens, and credentials. Omitting a sensitivity warning increases the chance that users will pass highly privileged data into the skill without informed consent or minimization.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The markdown provides invocation examples like "Validate package.json" and "Check .env file" without defining a specific trigger set, activation boundary, or exclusion conditions. These phrases are short, natural requests that could overlap with ordinary conversation about files, making unintended invocation more likely.

Static analysis

No suspicious patterns detected.