ClawHub
Back to skill

Security audit

技能工具

Security checks for vulnerabilities and agentic risk

Overview

This Hugo publishing skill is mostly purpose-aligned, but it can read broad user memory files and publish changes with Git push without a clear confirmation step.

Review the target repository, generated files, Git diff, commit message, and remote before allowing this skill to push. Prefer providing the blog path directly instead of letting it read MEMORY.md or USER.md, and do not use it with credentials or private notes stored in those files unless you are comfortable exposing them to the active task.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:82
Finding

Overbroad Access to Persistent Agent Memory Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 82
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Code Snippet:

text
1. 读取用户记忆文件(`MEMORY.md`/`USER.md`)获取博客配置

Technical Analysis

The skill instructs the agent to read the general-purpose persistent files MEMORY.md and USER.md to obtain a blog configuration. These files may contain unrelated user preferences, personal information, credentials, conversation-derived state, or configuration for other tasks.

Reading entire persistent memory files is not necessary for the stated publishing workflow and violates least-privilege principles. The required blog path could instead be supplied explicitly or stored in a dedicated, narrowly scoped configuration file. The skill does not define field-level allowlisting, content minimization, or authorization checks before this access occurs.

The audit found no instruction to exfiltrate the retrieved information. The risk is unnecessary exposure of persistent user information to the active agent context, where it could be accidentally incorporated into generated content, logs, tool arguments, or subsequent operations.

Attack Path

  1. A user invokes the Hugo publishing skill.
  2. Following the documented workflow, the agent opens MEMORY.md or USER.md.
  3. The file contains both the desired blog path and unrelated sensitive information.
  4. The entire content becomes available in the active execution context.
  5. Unrelated information may then be accidentally disclosed through generated articles, command arguments, diagnostic output, or later context processing.

Impact Assessment

Exploitation could expose information stored in persistent agent or user-memory files to the current skill execution context. The scope is limited to files the executing agent can already read; the instruction does not itself grant operating-system privileges or bypass filesy ...[truncated 330 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require the blog path to be provided as an explicit skill argument.
  2. Alternatively, use a dedicated configuration file such as .hugo-publisher.json containing only required fields.
  3. Do not read MEMORY.md or USER.md by default.
  4. If memory access is unavoidable, request explicit user confirmation and read only a specifically identified, allowlisted configuration field.
  5. Validate that the resolved blog path points to the intended Hugo repository before writing files or running Git commands.
  6. Ensure sensitive values are excluded from generated content, logs, command output, and Git commits.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

text

### 4. 截断标记与Git推送
在领先段或导言后添加 `<!--more-->`，让列表页显示摘要.
从博客目录自动检测git状态并推送：
```bash
cd {博客路径}

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

text

### 4. 截断标记与Git推送
在领先段或导言后添加 `<!--more-->`,让列表页显示摘要.
从博客目录自动检测git状态并推送:
```bash
cd {博客路径}

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
# ...
本文介绍静态站点的部署流程.
# ...
<!--more-->
# ...
## 准备工作
# ...

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
# ...
本文介绍静态站点的部署流程.
# ...
<!--more-->
# ...
## 准备工作
# ...

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description is overly generic and does not clearly disclose that the skill will modify a local Hugo repository, create content files, and push commits to a remote Git repository. This can cause users or orchestrators to invoke the skill without understanding that it performs state-changing local and remote publication actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow includes creating article files, creating taxonomy mapping files, and pushing commits, but it does not present an explicit warning or confirmation step before modifying local content and publishing remotely. In an agent setting, silent state-changing and networked publication behavior can lead to unintended disclosure or irreversible publication of content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The presented name/summary frame the skill as a generic development utility rather than a Hugo blog publisher with repository write and Git push behavior. This understatement increases the chance of accidental invocation and weakens informed consent around publishing operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the agent to read MEMORY.md/USER.md for blog configuration without warning that user configuration data will be accessed. Even if intended for setup, accessing user memory/config files without disclosure can expose sensitive paths, tokens, or personal configuration details.

Content

No source excerpt is available for this finding.