ClawHub
Back to skill

Security audit

Aws Wechat Article W

Security checks for vulnerabilities and agentic risk

Overview

This skill is a WeChat article-writing helper, but it asks the agent to use credentials, shell execution, file writes, and external LLM transmission beyond the manifest's declared read-only capability.

Install only if you expect this skill to draft Chinese WeChat articles, are comfortable with article content and selected reference documents being sent to your configured LLM endpoint, and can use a dedicated WRITING_MODEL_API_KEY. Review the companion scripts and suite source before use, because this artifact itself does not include write.py and its manifest under-declares the authority described in the instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest advertises only the read tool, but the body documents materially broader capabilities: local file writes, shell execution, reading credentials, and sending both content and an authorization bearer token to an external endpoint. This is a dangerous capability mismatch because security policy, consent, and sandboxing decisions may be made from the manifest, causing operators to trust a skill that can exfiltrate data and modify files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The output documentation says the skill produces article.md, but the workflow repeatedly states a hard boundary that this skill must only produce draft.md and must not bypass review. This inconsistency can cause downstream agents or users to skip the review step and treat unreviewed content as final, undermining content-safety and process controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The summary and description present the skill entirely in Chinese and position its behavior around Chinese-language WeChat article writing, but they do not explicitly state that this locale is required or offer the user a language choice. For organizational language policy review, this can constitute a forced language/locale assumption without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill documentation contradicts itself about API key usage: one section claims no extra API key is needed, while earlier sections state that WRITING_MODEL_API_KEY is read from aws.env and sent to a user-configured external LLM endpoint. This discrepancy can mislead operators into approving or installing the skill without understanding that credentials and article content will be transmitted off-host.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The listed trigger keywords include broad, common terms such as "writing" and generic brand/topic combinations like "aws", "wechat", and "article" without clear activation boundaries or exclusion conditions. In a markdown skill file, this can cause unintended invocation because the trigger scope is not narrowly defined to specific commands or contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.