ClawHub
Back to skill

Security audit

YAML处理工具

Security checks for vulnerabilities and agentic risk

Overview

This YAML skill is not clearly malicious, but it asks for broad command and API capabilities that are not well scoped to YAML handling.

Review this before installing. It appears to be a generated YAML helper rather than malware, but its declared exec and API capabilities are broader than its YAML purpose. Install only if you are comfortable with the agent using local commands and possible external service calls under this skill, or require the publisher to remove or tightly scope those capabilities.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill is presented as a YAML authoring/parsing tool, yet it advertises command execution capability that is not justified by its stated purpose. That mismatch can cause an agent to invoke shell execution in situations where only text transformation should occur, expanding the attack surface to arbitrary code execution or unsafe local actions if later prompts influence command selection.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The documentation claims external API integration even though the skill’s core function is YAML processing. Unnecessary network capability broadens data-exfiltration and prompt-injection risk, especially if YAML content or surrounding context is sent to third-party services without a clear need.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The manifest and description frame the skill as a YAML-focused utility, but the documentation broadens it into a general automation tool with file I/O, APIs, and command execution. This capability creep is dangerous because agents may route unrelated tasks to the skill and grant it access to higher-risk operations under the benign label of YAML handling.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The core capability statement says the skill writes valid YAML, but later feature text describes a broader execution and automation tool. This inconsistency can mislead both users and orchestrators about what privileges are appropriate, increasing the chance that dangerous actions are authorized under a low-risk description.

Static analysis

No suspicious patterns detected.