ClawHub
Back to skill

Security audit

综合生成工具-专业版

Security checks for vulnerabilities and agentic risk

Overview

This media-generation skill is broadly purpose-aligned, but it needs review because it asks for command and file access while giving broad activation language and weak safety boundaries for automated CLI/API workflows.

Install only if you intend to use dlazy for media generation and are comfortable granting command execution plus file read/write access. Configure the API key carefully, expect network calls and possible paid usage, use dry runs where available, and avoid feeding untrusted batch scenario data into the sample automation code without validation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documented Python batch-execution flow interpolates scenario-controlled values into command arguments via format(**scenario) before passing them to a CLI that can trigger external API actions and media processing. Even though subprocess.run is invoked with a list rather than shell=True, untrusted data can still become dangerous option values, file paths, or special pipeline references for the downstream tool, contradicting the skill's own safety guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill declares an extremely broad keyword-based coverage scope, including fragmented generic terms such as 'Use', 'when', '企业团队', and workflow-related phrases. In agent ecosystems, this can cause the skill to activate in unrelated contexts, increasing the chance that exec/write/network-capable behavior is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The examples show commands that install tools, authenticate with an API key, call external services, and write output files, but these side effects are not prominently disclosed before the examples. In an agent skill with read/exec/write tools, this can lead users or agents to perform networked or filesystem-modifying actions without clear advance consent.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High
Category
Output Handling
Confidence
83% confidence
Finding

The code blindly trusts and parses stdout from an external CLI, then stores the resulting JSON as structured output without validation. If the external tool returns attacker-influenced content, that data can drive subsequent agent decisions, file operations, or chained commands, creating an output-injection path in a skill explicitly designed for pipelines and automation.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
steps = []
            for step in self.pipeline:
                cmd = self._build_command(step, scenario)
                result = subprocess.run(cmd, capture_output=True, text=True)
                try:
                    output = json.loads(result.stdout)
                    steps.append({"step": step["type"], "output": output})

Static analysis

No suspicious patterns detected.