Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
ClawHub Skill 发布避坑指南
Security checks for vulnerabilities and agentic risk
Overview
This is a Chinese Markdown guide for publishing ClawHub skills; it has broad triggers and a token-based curl example, but no hidden execution, persistence, or exfiltration.
Before installing, be aware that this skill is written mostly in Chinese and may activate on generic publish/update requests. Only run the included curl publishing example after reviewing the ClawHub developer terms and confirming the payload, because it reads your local ClawHub token and publishes to your account.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file presents the skill description and all user-facing guidance entirely in Chinese, while also including English trigger phrases, but it does not state that output will follow the user's language preference or offer a language choice. This can violate a language/locale policy when users invoke the skill in another language without explicit opt-in to Chinese responses.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad phrases like '发布', '更新', and generic publication-related terms that can match many unrelated user requests. This can cause unintended invocation of the skill, exposing users to irrelevant instructions, increasing prompt-routing confusion, and making it easier for an attacker to hijack benign conversations with a broadly matching skill.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 95% confidence
- Finding
The trigger '发布' is extremely short and generic, making accidental activation likely across many unrelated conversations about publishing, releasing, or posting content. While not a direct code-execution issue, broad activation expands the skill's attack surface and can interfere with correct routing to more appropriate skills or system behaviors.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 95% confidence
- Finding
The trigger '更新' is similarly overbroad and can match many ordinary requests involving updates, upgrades, or edits unrelated to ClawHub skill publishing. This increases unintended invocation risk and could let the skill appear in contexts where its guidance is irrelevant or confusing.
- Content
Static analysis
No suspicious patterns detected.