ClawHub
Back to skill

Security audit

JavaScript规范工具(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This looks like a JavaScript style helper, but it declares broad command, file-write, and browser capabilities that are not well scoped to that purpose.

Install only if you are comfortable with the hosting agent limiting this skill to read-only review or requiring explicit confirmation before commands, file changes, or network access. Treat reviewed code and comments as untrusted, and avoid granting broad write, browser, or shell permissions for routine style guidance.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:6
Finding

Excessive and Inconsistent Tool Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–23
Vulnerability Type: Excessive tool permissions and ambiguous access-control configuration
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: read exec
compatibility: "Requires LLM with tool-use capability"
metadata:
  displayName: "JavaScript规范工具(免费版)"
  version: "1.0.0"
  summary: "面向个人开发者的JavaScript代码风格指南,涵盖核心规则与基础代码审查能力。"
  tags:
    - "Development"
    - "Frontend"
    - "JavaScript"
    - "代码规范"
  source: "SkillHub"
  converted_at: "2026-07-22T17:58:36"
tools:
  - exec
  - read
  - write
  - browser

Technical Analysis

The Skill is presented as a Markdown-based JavaScript style guide and basic code-review assistant. Its normal functionality primarily requires reading source code and returning recommendations. Nevertheless, the configuration declares command-execution, file-write, and browser capabilities.

The two permission declarations are also inconsistent: allowed-tools grants read and exec, while the separate tools list additionally includes write and browser. Agent platforms may interpret these fields differently or select the broader declaration. This ambiguity can result in capabilities being exposed beyond those necessary for the stated task.

No instructions in the audited file automatically exploit these permissions, and no malicious command or payload was found. The risk arises because the excessive capabilities increase the consequences of hostile user input, prompt injection embedded in reviewed content, or unsafe Agent behavior.

Attack Path

  1. The Skill is loaded by an Agent platform that honors the tools list or otherwise resolves the conflicting declarations in favor of the broader permission set.
  2. An attacker supplies JavaScript, comments, documentation, or another prompt containing instructions intended to influence the Agent.
  3. The injected instructions req ...[truncated 1335 chars]
Remediation
View remediation

Remediation Suggestions

  1. Apply least privilege by retaining only read for source-review workflows.
  2. Remove exec, write, and browser unless a documented feature strictly requires each capability.
  3. Consolidate permissions into one authoritative, platform-supported field to eliminate conflicting interpretations.
  4. If automated formatting is required, expose narrowly scoped formatting operations rather than unrestricted command execution.
  5. Require explicit user confirmation before any command execution, file modification, or network access.
  6. Restrict command execution to a fixed allowlist with constant arguments; never concatenate reviewed content or user input into shell commands.
  7. Limit write access to explicitly selected project files and prevent access outside the workspace.
  8. Run the Agent in a sandbox with minimal filesystem, process, environment-variable, and network permissions.
  9. Treat reviewed source code and comments as untrusted data and ensure they cannot override Skill or system instructions.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The declared tool set includes write and browser capabilities even though the skill is described as a JavaScript coding-style and review aid. Unnecessary capabilities violate least privilege and create avoidable risk that the agent may modify files or access external resources during tasks that should be limited to reading and generating guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation logic is overly broad, indicating the skill should activate for common development activities such as code generation, debugging, testing, and deployment. Because the skill also exposes stronger tools than its stated purpose requires, broad invocation increases the chance that it will be selected in contexts outside simple style guidance, leading to inappropriate actions or overreach.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is presented as a JavaScript style guide, but its documentation expands into generic operational behaviors such as create/query/modify/delete, export/save/convert, and network troubleshooting. This scope inflation can cause an agent to treat the skill as authorized for broader actions than users would reasonably expect, increasing the chance of unintended file, command, or workflow operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrasing is ambiguous and can match many ordinary JavaScript mentions, causing the skill to activate without clear user intent. In a skill with exec, write, and browser-adjacent framing, ambiguous invocation makes accidental use more dangerous because the agent may adopt an unnecessarily powerful instruction set for routine requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document claims the tool only provides suggestions and code snippets, but other sections describe modification, deletion, saving, and operational actions. This inconsistency can mislead users and downstream agents about the real authority of the skill, weakening informed consent and making unsafe tool use more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description explicitly states '支持中文交互' as part of the skill behavior, but does not indicate that users may choose another language. This can conflict with language/locale policy expectations when a skill appears to assume a specific interaction language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The functionality note lists Chinese interaction as a core capability, but there is no accompanying statement that output language follows user preference. This creates a mild natural-language policy concern because the skill presents a specific language mode without opt-in or alternatives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.