ClawHub
Back to skill

Security audit

Automation Recipe Book Free

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown automation recipe handbook, but users should review recipes before enabling any that send, reply, publish, back up data, or keep running on a schedule.

Install only if you want a Chinese-language automation recipe handbook. Before enabling any recipe, inspect its trigger, destination, source data, and schedule; require manual review for email replies and public publishing, and disable recipes you no longer need.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L33-L36 明确限定职责边界为“提供配方模板与使用指南”，并称配方执行由调度器、外部服务由对应技能负责，体现出文档型/指导型定位。但 L490 宣称核心能力支持“创建/查询/修改/删除等操作模式”，这超出了前述仅提供模板与指南的职责边界，属于文档内部对技能意图的直接冲突。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill presents itself as a handbook but includes instructions to create directories, copy files, inspect logs, and trigger automation in a writable local workspace. That mismatch increases the chance an agent will perform state-changing filesystem actions without the user appreciating that the skill can modify the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill includes file-creation and executable command guidance that modifies the local workspace, but it does not prominently warn users that it will write files and alter automation state. In an agentic environment with exec enabled, this can lead to unintended persistence, log creation, and recipe activation based on casual user requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

L144-L147 将 on_failure、retry、notify 作为配方统一结构的一部分进行说明，表示该技能支持失败处理与重试机制。但 L436-L440 又声明免费版限制“错误处理、重试机制”等高级功能，两处文档对同一能力是否存在形成直接冲突，容易误导用户对技能实际能力的判断。

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
75% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md
actions:
  - type: fetch
    url: https://news.ycombinator.com/rss
  - type: summarize
    prompt: "总结今日科技新闻，列出前5条"
  - type: send
    to: telegram

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The examples automate outbound actions like email replies, notifications, and multi-platform publishing without warning about privacy, authenticity, or accidental disclosure risks. In practice, these flows can send sensitive data externally, post hallucinated content, or trigger unintended communications if enabled without review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document explicitly highlights '完全中文化表达' as part of the redesigned skill, and the entire skill content/invocation guidance is presented only in Chinese. There is no indication that users may choose another language or that the Chinese-only constraint is required for a justified region-specific purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The capability keywords section is overly broad and ambiguous, which can cause an agent to over-apply the skill to requests involving automation, workflows, or efficiency without clear boundaries. In a tool-using environment, vague trigger scope raises the risk of activating state-changing behaviors in contexts the user did not explicitly intend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

L453-L488 的多个能力模板反复声明“遵循单一意图原则”，给人的预期是每项能力边界清晰、操作单一。但 L490 又统一声明支持“创建/查询/修改/删除等操作模式”，将多类读写行为混合到同一技能能力定义中，与前述单一意图表述不一致。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.