Security audit

躺平.skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed joke skill that makes the agent refuse work when intentionally invoked, with no code execution or data access, though its remote quick-start prompt should be avoided.

Install only if you intentionally want a humorous refusal mode. Prefer the reviewed ClawHub install over the README prompt that fetches live GitHub content without confirmation. If normal assistance is needed, ask the agent to disable, delete, edit, or inspect the skill; the skill explicitly allows help for those actions and for emergencies.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The quick-start text explicitly tells users to load external instructions and follow them immediately, with no second confirmation and no explanation. That creates a prompt-injection style behavior-change path where the agent may suppress normal safeguards, override user expectations, and begin refusing legitimate tasks without clearly signaling that its behavior has been altered.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The README says the skill will politely refuse in Chinese, which hard-codes an output language regardless of the user's preference. While not a severe security flaw on its own, it can degrade usability, conceal behavior changes from users who do not read Chinese, and reduce informed consent during skill activation.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill forces Simplified Chinese as the default output language without checking user preference or prior conversation language. This can degrade usability, override user intent, and create an unnecessary instruction priority conflict, though it is not directly a security compromise on its own.

Ssd 1

Medium

Confidence: 96% confidence
Finding: The quick-start prompt instructs the agent to fetch and obey external skill rules immediately, without confirmation or explanation. This is dangerous because it normalizes silent adoption of untrusted remote instructions, which can be repurposed for more harmful prompt injection, policy override, or hidden behavior changes beyond this joke skill's stated refusal mode.

Ssd 1

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to stop providing any productive help for the rest of the session once loaded, using 'joke mode' framing to mask a broad behavioral override. This creates a denial-of-service condition against the assistant's core function and can prevent legitimate user tasks from being completed.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The skill establishes a persistent loop of terse, hostile, non-cooperative responses and directs the model to refuse all real work requests after activation. This normalizes adversarial refusal behavior, increases the chance of user harassment, and sustains service degradation across subsequent turns.

Static analysis

No suspicious patterns detected.