ClawHub
Back to skill

Security audit

Shop Culture Tool Free

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a marketing-copy helper, but it asks for file-writing and command-execution powers that are not explained or needed for that purpose.

Review this skill before installing. It does not show malicious payloads, but a normal copywriting assistant should not need command execution or broad file-writing access. Install only in a sandboxed environment or after the publisher removes exec/write or clearly limits and explains any file operations.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:25
Finding

Excessive and Ambiguous Tool Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-32
Vulnerability Type: Violation of least privilege through unnecessary filesystem and command-execution capabilities
Risk Level: Medium

Vulnerable Code

yaml
tools:
- - read
- exec
homepage: https://skillhub.cn
pricing_tier: L3
pricing_model: per_use
suggested_price: 29.9
tools: ["read", "write", "exec"]

Technical Analysis

The Skill is documented as a Markdown-driven assistant that generates marketing copy, brand stories, social-media content, customer-service responses, and promotion plans. These text-generation functions do not require arbitrary command execution or unrestricted filesystem access.

Nevertheless, the metadata requests read, write, and exec. Granting these tools exposes capabilities beyond the Skill's stated operational requirements:

  • read may expose local files available to the Agent.
  • write may permit local data modification or creation.
  • exec may permit arbitrary operating-system command execution under the Agent process's identity.

The metadata also defines tools twice and uses an unusual nested-list structure in the first declaration. YAML parsers may reject duplicate keys, retain the first value, or retain the last value. Consequently, permission interpretation may vary between platforms and validation pipelines. Under common last-key-wins behavior, all three powerful capabilities are requested.

This finding concerns capability exposure. The reviewed file does not itself contain instructions that explicitly exploit these permissions.

Attack Path

  1. A platform loads SKILL.md and parses its metadata.
  2. The platform retains the final tools declaration or otherwise grants the requested read, write, and exec capabilities.
  3. A user supplies adversarial content intended to influence the tool-enabled Agent.
  4. If the Agent follows that content without adequate authorization checks, it can invoke capabilities unrelated ...[truncated 953 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the tool declaration entirely if the Skill only generates textual responses.
  2. If output persistence is necessary, request only the narrowly required write capability and require explicit user authorization before writing.
  3. Do not grant exec unless a documented feature has an unavoidable need for command execution.
  4. Avoid broad filesystem access. Where supported, constrain access to a dedicated Skill-owned directory.
  5. Keep exactly one canonical tools key with a schema-valid value.
  6. Add automated metadata validation that rejects duplicate YAML keys and malformed nested permission lists.
  7. Enforce permissions at runtime rather than trusting metadata alone:
    • Require per-operation authorization.
    • Apply command and path allowlists.
    • Run the Skill in a restricted sandbox.
    • Prevent access to credentials, sensitive configuration, and unrelated user files.
  8. Add tests confirming that ordinary content-generation requests cannot invoke filesystem or process-execution tools.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

文件标题、描述、示例输出和模板均固定为中文内容，且配置示例在 L275 直接将 language 设为“zh”，没有说明是否支持其他语言或允许用户选择语言。根据规则，未经用户选择即默认强制特定语言/区域风格，构成自然语言层面的语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill presents itself as a pure Markdown/local content-generation helper, but its manifest grants both write and exec capabilities. This mismatch expands the attack surface: an agent or user may trust the skill as low-risk while it can actually modify files or run commands, enabling unintended system or data impact if invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill describes modify/reset/import/export/save-style operations without any user risk notice, approval flow, or data-scope constraints. In a skill that also declares write and exec, vague data-affecting operations can lead to accidental overwrites, unauthorized exports, or unsafe handling of local files and user content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L223-L225 将触发条件写为“需要电商运营、商品管理、订单处理、支付集成时使用”，但文档其余部分主要描述的是品牌故事、营销文案、社交媒体内容和促销文案生成，并未提供订单处理或支付集成能力。这种宽泛且不准确的触发范围容易与常见电商需求重叠，导致用户或代理在不适合的场景下调用该技能。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation explicitly claims the skill is a pure Markdown instruction/template skill with local generation, yet the manifest grants exec/write access. This contradiction can mislead operators, reviewers, and automated policy systems into underestimating the privilege level of the skill, increasing the chance of unsafe deployment or execution.

Content

No source excerpt is available for this finding.