ClawHub
Back to skill

Security audit

游戏资产生成-免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is a game-asset prompt helper, but it requests general command execution and describes broad file/API/search capabilities that are not clearly needed for that purpose.

Review this skill before installing. It does not show malware or persistence, but it grants shell execution for a task that appears mostly prompt-based. Install only in a constrained sandbox, avoid giving it access to sensitive workspaces or secrets, and prefer a version that removes exec or tightly documents and enforces the exact commands it may run.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:5
Finding

Unnecessary General-Purpose Command Execution Permission

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-18
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: read exec
compatibility: "Requires LLM with tool-use capability"
metadata:
  displayName: "游戏资产生成-免费版"
  version: "1.0.0"
  summary: "轻量级2D游戏资产生成工具，支持角色设计、精灵图与瓦片集，保持风格一致。"
  tags:
    - "Creative"
    - "GameDev"
    - "2D"
  source: "SkillHub"
  converted_at: "2026-07-22T17:58:36"
tools:
  - exec
  - read

The document also acknowledges the command-execution risk at lines 377-380:

markdown
| Risk Type | Preventive Measure |
|----------|---------|
| API key leakage | Configure through environment variables; never hardcode keys in code or configuration files |
| Command execution risk | Execute only allowlisted commands and avoid concatenating user input into command-line arguments |
| Network communication security | Use HTTPS and validate SSL certificates |

However, the package does not define or implement an enforceable command allowlist.

Technical Analysis

The Skill grants the Agent access to the general-purpose exec tool even though its demonstrated functionality consists primarily of constructing natural-language prompts for 2D game assets. The concrete shell examples only print text, and the error-handling section suggests running ping. Neither function requires unrestricted command execution.

General-purpose shell access substantially expands the Skill's effective authority. Depending on the hosting Agent's sandbox and operating-system permissions, exec may provide access to local files, environment variables, processes, installed utilities, and network-capable commands. A textual recommendation to use an allowlist does not enforce that restriction at runtime.

No directly malicious command, command-injection implementation, credential-stealing log ...[truncated 1790 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove exec from both allowed-tools and tools because the documented prompt-generation workflow does not require arbitrary command execution.
  2. Retain only the minimum tool permissions needed for the Skill, such as read-only access where genuinely required.
  3. Replace shell-based examples that merely print text with plain Markdown examples or Agent-generated text.
  4. If network diagnostics are essential, provide a narrowly scoped diagnostic tool rather than access to a shell.
  5. Enforce a fixed command allowlist in code or platform policy; do not rely on textual instructions in SKILL.md.
  6. Validate every argument against a strict schema. Reject shell metacharacters, redirections, command substitutions, additional commands, and untrusted hostnames.
  7. Execute any indispensable command in a restricted sandbox with minimal filesystem access, no inherited secrets, limited network access, resource limits, and a non-privileged identity.
  8. Require explicit user approval before executing commands that affect files, processes, or network resources.
  9. Add tests confirming that unexpected commands and attacker-controlled arguments are denied.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
prompt += f"\n    色彩方案: {details.get('palette', '暖色调')}"
    prompt += f"\n    尺寸规格: {details.get('size', '32x32像素')}"
    return prompt

# 像素风主角设计
character = {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description states '支持中文交互' and the document consistently frames operation in Chinese, but does not explicitly offer a language choice or indicate that Chinese is optional. Under the policy, language constraints should not be imposed without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is overly broad, extending from game assets into general design, UI, posters, and brand visuals. Overbroad routing criteria are dangerous in agent environments because they increase the likelihood that unrelated user requests will activate a skill that has read/exec privileges, expanding exposure beyond its stated niche.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation is internally inconsistent: it claims to be pure Markdown with no extra API key, while also asserting API integration, HTTPS communication, network troubleshooting, and command execution. These contradictions obscure the real trust boundary and can mislead operators into granting broader permissions than expected, which is a security-relevant design flaw.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Command execution is not reasonably necessary for a Markdown-driven 2D asset generation skill, yet the skill advertises exec capability. Unjustified shell access materially raises risk because an agent may run local commands, probe the network, or manipulate files in response to ordinary design requests that should never need system execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is presented as a narrowly scoped 2D game asset generator, but its documented capabilities expand into generic file handling, API access, command execution, and information retrieval. This scope inflation is dangerous because it can cause an agent to invoke broad, high-risk tool behaviors under the guise of a benign creative task, increasing the chance of unauthorized file access or unintended system interaction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.