ClawHub
Back to skill

Security audit

Support Template Multilang Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it directs agents to sync support content externally and update/publish the skill itself without clear user confirmation or scope limits.

Install only if you are comfortable with an agent editing support templates and potentially writing content to Feishu, GitHub, and ClawHub. Require a manual review before any sync, GitHub issue creation, skill update, or ClawHub publish, and check templates for internal or customer-sensitive data first.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The instruction to 'Update this skill if the process or API assumptions improved' authorizes self-modification of the operational instructions that govern future executions. In an agent context, self-modification is dangerous because it can silently weaken safeguards, expand behavior over time, or persist unsafe actions into a reusable skill that is later packaged and published.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
3. Re-read the file and verify each response block has the expected languages and no placeholder drift.
4. Sync the finalized content to Feishu Wiki.
5. Create a GitHub issue that records what changed, which file changed, and what follow-up is needed.
6. Update this skill if the process or API assumptions improved.
7. Package the skill and publish it to ClawHub when credentials are available.

## File Update Rules

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
- `SKILL.md` with trigger-oriented description.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill directs the agent to read and modify local files, sync content to Feishu, create GitHub issues, and publish to ClawHub, but it declares no explicit tool scope or permission boundaries. This creates an authorization and transparency gap: an agent may use capabilities the user did not clearly approve, increasing the chance of unintended file access or external publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The workflow instructs the agent to sync support content to Feishu, log it in GitHub, and publish a reusable skill, but it does not require a clear warning or confirmation before sending potentially sensitive internal support material to external services. In context, this increases the risk of accidental data disclosure, especially if templates contain internal procedures, customer identifiers, or operational details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The instructions prescribe maintaining support content across named languages and normalize response structure, but they do not indicate that language selection should be based on user preference or opt-in. This can create a locale-handling policy concern because the skill appears to assume and enforce specific language outputs by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.