ClawHub
Back to skill

Security audit

CSS工具箱(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a CSS reference skill, but it asks for command execution and file-writing powers that its own documentation says it does not need.

Review this before installing because it should be a read-only CSS reference. Prefer a version that removes exec and write permissions or clearly explains and scopes any file changes or command execution. I did not find evidence of malware, persistence, credential theft, or exfiltration.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:21
Finding

Unnecessary Shell Execution and File-Write Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–24
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

yaml
tools:
  - read
  - exec
  - write

The inconsistency is confirmed by the Skill's own declaration at line 288:

markdown
- **分类**：MD（纯 Markdown 指令，无需 exec 命令行执行能力）

This states that the Skill is pure Markdown and does not require command-line execution.

Technical Analysis

The Skill is an offline CSS reference document, but its metadata requests exec and write. No reviewed functionality requires shell execution or file modification. Granting these tools therefore violates the principle of least privilege.

The document also recommends running ping for network troubleshooting at line 310, but this does not justify general shell access for the Skill's core CSS-consultation purpose. No direct malicious command, attacker-controlled command interpolation, or automatic invocation was identified.

Attack Path

  1. A user installs or loads the Skill.
  2. The Agent platform interprets the tools declaration and grants exec and write.
  3. The Skill operates with command-execution and filesystem-modification capabilities unrelated to its stated purpose.
  4. If the Skill instructions are later compromised, modified, or combined with injected content, those unnecessary capabilities could be invoked to execute local commands or modify accessible files.

This is a privilege-enablement path rather than evidence that the current document actively performs malicious execution.

Impact Assessment

On platforms that automatically honor declared tools, the Skill may obtain:

  • Shell-command execution within the Agent process's security context.
  • Modification of files accessible to that process.
  • Potential access to local resources exposed through shell commands.

The precise scope depends on platform sandboxing, operating-system permissions, and ...[truncated 182 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove exec and write from the declared tools:
    yaml
    tools:
  - read
  2. If the platform does not require read for document loading, remove all tool declarations.
  3. Replace the ping instruction at line 310 with optional, user-directed diagnostic guidance that does not cause the Agent to execute commands.
  4. Enforce tool authorization at runtime rather than trusting package metadata alone.
  5. Sandbox any future command capability and require explicit user approval for each invocation.
  6. Add a manifest validation rule that rejects permissions inconsistent with the Skill's documented capability classification.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill presents itself as a pure offline CSS reference, yet the manifest grants both exec and write capabilities and describes operational workflows. This mismatch expands the skill’s effective privilege surface beyond what users would reasonably expect, increasing the chance that an agent may execute commands or modify files under a benign-looking documentation skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documentation explicitly states that the skill is pure Markdown and does not require exec capability, while the manifest enables exec. This contradiction can mislead reviewers and users into trusting a skill as non-executable when it can in fact run commands, which is a classic dangerous capability discrepancy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The invocation language is overly broad, covering generic code generation, debugging, testing, and deployment contexts far beyond a CSS pitfalls handbook. This can cause the skill to activate in unrelated scenarios while carrying unnecessary privileges, increasing the chance of misuse or unintended tool access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Write access is not justified for a documentation/reference skill and permits file modification without a clear need. That capability could enable unintended or unauthorized changes to project files if the agent over-applies the skill during routine development assistance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Write access is not justified for a documentation/reference skill and permits file modification without a clear need. That capability could enable unintended or unauthorized changes to project files if the agent over-applies the skill during routine development assistance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The coverage statement uses a very broad keyword list to define activation scope, without meaningful constraints. Broad matching raises the risk that the skill will be selected for loosely related development tasks where its declared privileges are unnecessary and potentially unsafe.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill claims it is offline-only and requires no network requests, but later instructs network troubleshooting with ping. Even if benign, this inconsistency can cause an agent to perform unnecessary network activity, violating user expectations and weakening trust boundaries around an allegedly offline skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The description blends Chinese with English fragments like 'Use' and 'when' in a fixed way, but does not tell users they may interact in their preferred language. Under the language/locale policy, skills should not impose a specific language style without opt-in or an explicit justified constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.