ClawHub
Back to skill

Security audit

博客写作助手基础版

Security checks for vulnerabilities and agentic risk

Overview

This blog-writing skill is mostly coherent, but it asks for broad tool and credential-related behavior while making inconsistent privacy claims.

Install only if you are comfortable supervising its file, shell, and network/API use. Do not let it enumerate environment variables or handle unrelated credentials, and treat the local-data privacy claim as incomplete because the skill also describes callbacks and external APIs.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

High
Confidence
94% confidence
Finding
The documentation makes a strong privacy/security claim that FREE-version data stays local, while elsewhere the skill supports callback URLs, external API use, and network-dependent features. This can mislead users into providing sensitive drafts, links, or credentials under false assumptions about data handling, creating confidentiality and compliance risk.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill includes instructions to inspect environment variables for API keys/tokens and generic API-connection setup guidance that is broader than necessary for a blog-writing assistant. Even though the sample masks values, prompting an agent to enumerate secret-bearing environment variables increases the chance of accidental exposure, logging, or misuse of credentials.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill is framed as a content-writing tool, but later expands into generic file processing, command execution, API calling, and multi-interface aggregation workflows. This scope creep is dangerous because broad operational instructions can cause an agent to perform actions unrelated to the user's writing task, including filesystem and shell activity with unnecessary access.

Static analysis

No suspicious patterns detected.