ClawHub
Back to skill

Security audit

OPC Framework

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill suite is coherent, but some development, deployment, and operations guidance can affect production systems and business workflows without enough explicit approval safeguards.

Install only if you intend to use this as a planning and checklist suite, and require explicit approval before cloning templates, installing dependencies, touching production, running migrations, changing environment variables, publishing content, connecting automations, or shutting down resources. Verify third-party boilerplates, domains, trademarks, and any operational integrations independently.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
development/SKILL_EN.md:23
Finding

Unpinned Third-Party Boilerplate Introduces Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: development/SKILL_EN.md:23
Vulnerability Type: Unpinned and insufficiently verified third-party dependency source
Risk Level: Medium

Vulnerable Code Snippet:

markdown
*   Do not build from scratch. Select an appropriate starter template from [awesome-saas-boilerplates](https://github.com/smashing-mag/awesome-saas-boilerplates) based on your tech stack.

The equivalent instruction also appears in development/SKILL_ZH.md:23, while development/SKILL_ZH.md:51 explicitly describes cloning a boilerplate and configuring environment variables.

Technical Analysis

The development skill instructs the agent to select third-party starter code from a mutable external catalog. It does not specify an approved repository, immutable commit hash, signed release, checksum, dependency lockfile, or mandatory security review.

The catalog and repositories it references can change after this skill package has been audited. A selected template may contain malicious or compromised package dependencies, lifecycle scripts, build plugins, CI workflows, configuration files, or application code. If the agent clones the template and installs or builds it without additional review, attacker-controlled code could execute in the developer or CI environment.

The issue is classified as an insecure dependency rather than direct remote payload execution because this package does not itself implement a download-and-execute command. Exploitation depends on a subsequent development workflow selecting and executing unsafe third-party components.

Attack Path

  1. An attacker compromises a repository listed in the external boilerplate catalog, or gets a malicious repository added to it.
  2. The agent follows the skill instruction and selects that repository based on the requested technology stack.
  3. The repository is cloned without pinning it to a previously reviewed commit or verifying its pro ...[truncated 1117 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace open-ended catalog selection with an explicit allowlist of reviewed repositories.
  2. Pin every approved template to an immutable commit hash or cryptographically signed release.
  3. Record and verify repository ownership, release signatures, and expected checksums before use.
  4. Require explicit user approval before cloning a repository or running installation, setup, build, or migration commands.
  5. Review package manifests, lockfiles, lifecycle scripts, build plugins, CI workflows, container definitions, and setup scripts before execution.
  6. Install dependencies with lockfile-enforcing and integrity-verifying modes where supported.
  7. Run initial installation and builds in an isolated container or sandbox with no production credentials, SSH keys, cloud tokens, or unrelated filesystem access.
  8. Grant CI jobs only the minimum required permissions and do not expose deployment secrets to untrusted pull requests or initial template validation jobs.
  9. Add automated dependency, secret, malware, and static-analysis scans before accepting generated starter code.
  10. Apply the same controls to the equivalent instruction in development/SKILL_ZH.md.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · creative-planning/SKILL_EN.md (reported line 40)May include surrounding context.

md
Please output in the following Markdown structure:

### 1. Superpower Definition
- **Your Specific Knowledge**: [Clear statement of your unique advantage]
- **Why You**: [Why you are uniquely positioned to win here]

### 2. List of Directions

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown skill mandates a single language experience throughout the file, including description, instructions, and output requirements. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill gives step-by-step instructions for making live production changes, including database migrations, configuration updates, and service deployment, but does not include an explicit warning that these actions can affect real systems, customer traffic, and production data. In an agent setting, this increases the chance that the model or user will treat the procedure as routine and execute high-impact actions without adequate human approval or environment validation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file is written entirely in Chinese and instructs outputs in that language context, but it does not state that language selection is optional or limited to a justified region-specific use case. This can violate language/locale policy when users have not opted into Chinese output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description and parameterization are broad enough to authorize general software development from a PRD without meaningful scope limits, safety gates, or restricted trigger conditions. In an agent system, this can enable high-impact actions such as generating insecure code, implementing sensitive capabilities, or acting on ambiguous requirements, increasing the chance of misuse or unsafe autonomous behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction '请按照以下 Markdown 结构输出' appears in a Chinese-language skill file whose inputs and outputs are also specified in Chinese, effectively constraining interaction language to Chinese. The file does not state that language is optional or user-selectable, which can violate language/locale choice policy when no opt-in is provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description and scope are broad enough to authorize many operational actions across monitoring, support, content, sales, and workflow automation without clear boundaries, approval points, or environment restrictions. In an agent setting, this can lead to over-privileged invocation, unintended external integrations, or autonomous operational changes that affect production systems and business processes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction '请按照以下 Markdown 结构输出' requires the response format in Chinese and does not provide any user opt-in or alternative language option. This is a natural-language locale policy concern because the skill file is explicitly language-specific without documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill description is broad and does not meaningfully constrain when the operations skill should be invoked or what boundaries it must respect. In an agentic system, overly broad activation can cause the model to apply operational authority in unintended contexts, increasing the chance of unsafe actions, scope creep, or misuse of monitoring and incident-response capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest-style header and the entire skill body are written exclusively in Chinese, and line L27 explicitly instructs the model to output in a specific markdown structure in Chinese. There is no indication that the user can choose another language or that the locale restriction is required for a region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file consistently instructs the assistant in Chinese, and line L30 explicitly mandates the output format with Chinese section headings and wording. This imposes a specific language on users without opt-in or a documented regional/compliance reason, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown skill is written as a prescriptive output template beginning with a required Markdown structure in Chinese, and nowhere offers the user a language or locale option. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · social-listening/SKILL_EN.md (reported line 11)May include surrounding context.

md
# Social Listening Skill

## Role
You are a Digital Ethnographer and Data Detective. You don't just search keywords; you immerse yourself in communities to hear the "subtext" of users. You are not looking for "feature requests" but for "cries of pain". You believe in **The Mom Test**: don't ask users what they want, observe what they do.

## Input
- **Keywords**: Core terms related to product or problem (e.g., "alternative to", "sucks", "how to").

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description, inputs, outputs, and all operational instructions are written entirely in Chinese, and L28 explicitly instructs the model to output in the provided Chinese markdown structure. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata and output requirements are written entirely in Chinese, which effectively constrains interaction language without any indication of respecting the user's preferred language. In a meta-tool that routes users to other skills, this can reduce usability, cause misunderstanding of recommendations, and create inconsistent behavior for users expecting another language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description claims it can 'dynamically search and recommend the most suitable Skill based on task description' without defining boundaries, safe trigger conditions, or exclusion criteria. In an agent framework, overly broad routing/discovery skills can cause inappropriate tool selection, expanded access to higher-risk skills, or prompt-based steering into capabilities the user did not explicitly intend to invoke.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill claims it can provide 'registrable (or highly likely registrable)' domains while the process explicitly says availability is only simulated. That mismatch can mislead users into relying on inaccurate availability claims, causing wasted effort, brand decisions based on false assumptions, or accidental trademark/domain conflicts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file is a Chinese-language skill variant (SKILL_ZH.md), but it presents the main heading as "Proposal Writing Skill" and structures the behavior around English copywriting conventions without explicitly letting the user choose the output language. This can create a locale/language policy concern because the skill implicitly steers output toward a specific language style rather than documenting user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file is a Chinese skill document, but it hard-codes English query terms such as "alternative to", "sucks", "painful", and "hate", and includes English-only output examples. This creates a language-policy issue because the skill implicitly forces a specific language/locale behavior without telling the user they can choose alternatives.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This file is a markdown skill definition, so natural-language policy checks apply. The heading, instructions, and output requirements all assume English usage, but the skill does not state that English is optional, user-selectable, or required for a specific justified regional/compliance reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.