Ai Poison Guard

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:58 AM UTC
• Version: 1.0.0

Overview

This skill runs a local text-pattern scanner, but its documentation overstates source-verification capabilities and recommends unnecessary unpinned package installs.

Review this skill before installing. It appears to be a local heuristic text scanner, not a real source, domain, or website verifier. Avoid running the documented pip install command unless dependencies are pinned and actually needed, and do not treat low risk scores as proof that a source or website is trustworthy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

other

Note

• Location: scripts/guard.py:154

Finding

Hardcoded Promotional URL Injected into Detection Reports

Content

View full analysis

Vulnerability Details

File Location: scripts/guard.py, lines 154-157
Vulnerability Type: Unsolicited promotional output injection
Risk Level: Low

python

print(f"{Colors.BOLD}📖 参考：{Colors.RESET}")
print(f"  央视3·15晚会曝光 GEO 投毒案例")
print(f"  https://clawhub.ai/testmtcode/ai-poison-guard")

Technical Analysis

The report-generation function unconditionally appends a hardcoded external project URL to every non-JSON analysis report. This external destination is unrelated to the content being analyzed and is not required for the local pattern-matching functionality.

Because the URL is embedded directly into routine output, users may interpret it as an authoritative security reference. The content hosted at that destination can change independently after the package has been reviewed. No automatic network request or remote code execution occurs, but the behavior constitutes persistent promotional output injection and creates an external trust boundary that is not disclosed or controlled by the analysis logic.

Attack Path

1. A user invokes the skill to analyze text or a local file.
2. The program calls generate_report().
3. The report unconditionally includes the hardcoded external URL.
4. The user may follow the URL based on its placement as a security reference.
5. The external destination may expose the user to content that was not included in or validated by this audit.

Impact Assessment

No local privileges, credentials, or system access are obtained through the code itself. The scope is limited to manipulation of generated output and redirection of user attention to an unaudited external destination. The principal risks are misleading attribution, unsolicited promotion, and exposure to mutable third-party content.

Remediation

View remediation

Remediation Suggestions

• Remove the hardcoded URL from normal detection reports.
• If project attribution is necessary, expose it through an explicit --about or --version option.
• Do not present mutable external destinations as security references unless their purpose and ownership are clearly disclosed.
• If links must appear in reports, make their inclusion opt-in and maintain an allowlist of reviewed destinations.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:220

Finding

Unnecessary and Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 220-225
Vulnerability Type: Insecure dependency installation guidance
Risk Level: Medium

bash

pip3 install requests whois tldextract

Technical Analysis

The documentation instructs users to install three packages without version constraints, integrity hashes, or a reviewed lock file. Package resolution therefore depends on the mutable state of the configured Python package index and its transitive dependency graph.

These packages are not imported by scripts/guard.py. In addition, requirements.txt states that the current version performs purely local detection and lists the same packages only as commented-out possible future dependencies. The installation guidance therefore introduces supply-chain exposure without providing functionality required by the current implementation.

Python package installation may execute package-controlled build backend or installation logic. If a package, release, configured package index, or transitive dependency is compromised, following the documented command could execute attacker-controlled code with the privileges of the user running pip3.

Attack Path

1. A user follows the installation instructions in SKILL.md.
2. pip3 queries the user's configured package index and resolves the latest available versions and transitive dependencies.
3. A compromised, substituted, or malicious release is downloaded.
4. Package-controlled build or installation logic executes during installation.
5. The malicious package gains the permissions of the invoking user and may modify files, access user-readable data, or establish additional malicious behavior.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip3. If installation is performed with elevated privileges, the impact could extend system-wide. Potential consequences include user-data acces ...[truncated 220 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the installation command because the current implementation does not require these packages.
• If future functionality requires third-party packages, declare only the dependencies actually imported by the application.
• Pin exact reviewed versions in a lock file.
• Record and verify cryptographic hashes, such as by using pip install --require-hashes.
• Review direct and transitive dependencies before release.
• Use an isolated virtual environment and avoid elevated installation privileges.
• Ensure that the selected WHOIS package is the intended, actively maintained distribution rather than relying on an ambiguous package name.

other

Warning

• Location: SKILL.md:79

Finding

Documentation Advertises Source-Verification Features That Are Not Implemented

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-93
Vulnerability Type: Misleading security capability claims
Risk Level: Medium

bash

# Detect a link
python3 scripts/guard.py --detect-url "https://example.com/review"

# Verify a website
python3 scripts/guard.py --verify-source "https://example.com"

# Check a domain
python3 scripts/guard.py --check-domain "example.com"

The implementation defines only the following relevant arguments in scripts/guard.py, lines 166-170:

python

parser.add_argument("--detect-text", type=str, metavar="TEXT",
                    help="检测文本内容")
parser.add_argument("--detect-file", type=str, metavar="FILE",
                    help="检测文件内容")
parser.add_argument("--json", action="store_true",
                    help="输出 JSON 格式")

Technical Analysis

The documentation advertises URL detection, website verification, and domain reputation checks, but the command-line parser does not implement --detect-url, --verify-source, or --check-domain. The executable only reads supplied text or a UTF-8 file and applies fixed regular expressions and keyword checks.

Consequently, the program does not inspect domain registration age, HTTPS configuration, registration records, server location, shared IP addresses, or external reputation data. Invoking the documented options results in argument-parsing failure rather than source verification.

This is security-relevant because users may mistake lexical risk scoring for factual source validation. The tool can classify text that contains predefined phrases, but it cannot establish whether a source, domain, claim, or website is trustworthy.

Attack Path

1. A user reads the documented source-verification claims.
2. The user relies on the skill to assess a URL or domain.
3. The documented command fails because the relevant option is absent, or the user instead supplies URL-related text to the lex ...[truncated 713 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all unsupported URL, source-verification, and domain-checking claims and command examples.
• Clearly state that the current implementation performs only heuristic text matching.
• Explain that a low score does not establish truthfulness, domain reputation, or source authenticity.
• If these features are required, implement explicit command-line options with validated URL parsing, bounded network timeouts, redirect controls, and SSRF protections.
• Add automated tests confirming that every documented command is supported.
• Distinguish lexical indicators from independently verified facts in all reports and risk labels.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence

Finding

The skill advertises executable/scripted functionality and references file-based operations (for example, --detect-file suspicious.txt) but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause an agent platform to grant broader default capabilities than intended or leave reviewers unable to verify what filesystem access is actually required, increasing the risk of unintended file reads on user-controlled paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents its purpose, prompts, risk labels, and recommendations entirely in Chinese, indicating a fixed language/locale experience. The policy requires flagging language constraints unless the skill offers user opt-in or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill description is presented only in Chinese, and there is no indication that users can choose another language or that the skill is intended exclusively for a Chinese-speaking or region-specific audience. Under the policy rules, a fixed language requirement without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.