ClawHub
Back to skill

Security audit

设计免费版

Security checks for vulnerabilities and agentic risk

Overview

This is a frontend design guidance skill with some sloppy metadata but no evidence of hidden, destructive, or data-stealing behavior.

Install only if you want a broad frontend design assistant that can help edit and run checks in a project. Treat callback_url and API_KEY sections as vague boilerplate: do not provide secrets or callback endpoints unless you explicitly need that behavior and can confirm how your agent will handle them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown/manifest file repeatedly describes the skill as applicable to broad 'related development scenarios' and 'scenes needing frontend design 3 capabilities' without specifying concrete invocation phrases, scope boundaries, or exclusion conditions. That ambiguity could cause unintended invocation because the description overlaps with common design/development requests rather than a narrowly defined trigger context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Documenting a callback URL field without clearly warning that it may cause outbound notifications creates a latent SSRF/data-exfiltration risk if an agent or future implementation honors arbitrary user-supplied URLs. In an agent ecosystem with exec/write capabilities, this kind of undocumented network behavior can lead to sensitive data being transmitted to attacker-controlled endpoints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The input table explicitly documents callback_url as a URL for completion notifications, implying the skill will call back to that endpoint when processing finishes. Elsewhere, the file only describes local design-generation workflow and output formatting, with no corresponding callback, webhook, or network-delivery behavior, so the documentation overstates what the skill does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example output sets <html lang="zh">, which imposes a specific language/locale in natural-language content without any opt-in or note that the example is region-specific. This can violate language/locale policy when users expect language-neutral or user-selected output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file defines a concrete JSON response schema including success, execution_time, metadata, and execution_log, but the remainder of the skill is descriptive guidance and examples rather than executable code that would produce this structure. This is intent-code divergence because the documentation asserts a specific runtime output contract without corresponding implementation in the provided skill file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.