ClawHub
Back to skill

Security audit

多平台摄影配文

Security checks for vulnerabilities and agentic risk

Overview

This caption-writing skill is mostly a Markdown prompt, but it asks for broad read/write/shell authority and describes unrelated automation capabilities that are not clearly needed for captions.

Review this before installing. Use it only in a workspace where broad file access and shell execution would be acceptable, avoid exposing sensitive photos or secrets, and scope any API key narrowly. The captioning behavior itself is not deceptive, but the requested authority is broader than the visible task requires.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is presented as a photo-caption generator, but its documentation later claims broad file processing, API integration, command execution, and information-retrieval capabilities that are unnecessary for the stated purpose. This capability inflation increases the chance that an agent may grant or use powerful tools in unrelated contexts, expanding attack surface and enabling misuse beyond simple text generation.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
Declaring shell command execution for a caption-writing skill violates least privilege and creates an unnecessary path to system-level actions. If an agent honors this tool declaration, prompt injection or user-supplied content could be leveraged to run commands, access local data, or alter the environment despite the task only requiring text generation.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Generic read/write access is not necessary for generating social-media captions from user-provided photo context, and granting it broadens the skill's reach into local or workspace data. In an agent environment, this can enable unintended disclosure, modification, or persistence of data if the model is manipulated or misapplies the tools.

Static analysis

No suspicious patterns detected.