ClawHub
Back to skill

Security audit

Workflow Splitter Free

Security checks for vulnerabilities and agentic risk

Overview

This is a workflow-planning helper whose sensitive behavior is disclosed and limited to running a named CLI, though users should verify that CLI before use.

Before installing, verify what provides the workflow-splitter command and only let the agent run it for tasks you intended. Treat exported progress data as potentially containing task details, and prefer explicit confirmation before any execute step that could modify files or systems.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly permits the exec tool while presenting command examples and operational workflows, but it does not provide meaningful safety guidance, approval checkpoints, or limits on system-impacting actions. In an agent context, that can normalize command execution for user tasks and increase the chance of unintended local changes, unsafe network actions, or execution of attacker-influenced inputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest and surrounding documentation present the skill as a planner that decomposes tasks, matches models, and tracks progress. However, the inline capability notes state that progress tracking and diagnosis use input_params supporting '创建/查询/导出操作', which introduces create/export actions not reflected in the core description and conflicts with the stated 'free edition' limitations elsewhere.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The capability coverage text includes broad phrases such as '需要项目管理、任务规划、进度跟踪、团队协作时使用', which are generic everyday work requests rather than narrowly scoped invocation triggers. The file does not provide clear exclusion conditions or negative examples to distinguish when this skill should activate versus when a different planning or collaboration skill should be used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The copyright section explicitly states '完全中文化表达，适配中文用户工作流', and the entire skill is presented as Chinese-only, with no option for users to choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is clearly justified as region-specific.

Content

No source excerpt is available for this finding.