ClawHub
Back to skill

Security audit

快速事实核查

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent fact-checking skill with bounded web-search behavior and a read-only validator; the main caveats are documentation overclaims about speed and unpinned README install examples.

Install from the reviewed ClawHub artifact or pin a known release rather than relying on the README's unpinned remote install command. Expect the skill to use web search/fetch for factual verification, and treat its speed promise as aspirational because its own changelog says it was not proven faster than the baseline.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/check_answer.mjs (reported line 39)May include surrounding context.

js
export function checkAnswer(text) {
  const errors = [];
  if (typeof text !== "string") text = String(text == null ? "" : text);
  text = text.replace(/^/, "").replace(/\r\n?/g, "\n"); // strip BOM; normalize CRLF / lone-CR

  // --- Tier ---
  const tf = field(text, "Tier");

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description says the skill provides a 'Fast, source-backed answer' with a hard time budget and that 'speed is the goal.' This changelog explicitly records that evaluation against the bare model found the skill was never cheaper or faster, and retirement was recommended because the core speed claim was not supported. That is a semantic mismatch between the skill's stated behavior and its documented actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Line L147 says the bilingual README uses '中文 default', which indicates a default language/locale choice in natural language. In this file there is no accompanying opt-in, user choice, or clear region-specific justification, so it appears to conflict with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation examples use very broad natural-language triggers such as "fact-check this," "quickly look up X," and "what is <tech/term>." In an agent environment, overly generic phrasing can cause accidental or adversarial triggering of the skill in contexts where the user did not explicitly intend it, potentially leading to unnecessary web access, tool usage, or context switching.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.en.md (reported line 20)May include surrounding context.

md
**When to use** — "fact-check this" · "quickly look up X / is it true that Y" · "what is <tech/term>"; or call `/fact-check`.
**Not for** — exhaustive multi-source research reports (→ deep-research); subjective / recommendation questions ("best laptop for me"); domain deep-evaluations with their own skill (album-review for 乐评, hifi-review for audio gear).

**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/fact-check ~/.claude/skills/`).

Full spec: [SKILL.md](SKILL.md)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to install the skill via npx skills add VincentJiang06/skills without pinning a specific version or immutable reference. That exposes users to supply-chain risk because future upstream changes, account compromise, or a malicious republish could alter what gets installed without the reader noticing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README says the skill should be used for phrases like “查一下 X / X 是不是真的” and “某个技术/名词是什么,” which are very common conversational requests rather than narrowly scoped triggers. Although /fact-check is explicit, the surrounding examples are broad enough that the skill could be invoked unintentionally for ordinary queries.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md
**什么时候用** —— 「fact-check 一下」·「查一下 X / X 是不是真的」·「某个技术/名词是什么」；也可用 `/fact-check` 显式调用。
**不适用** —— 详尽的多源研究报告（→ deep-research）；主观 / 推荐类问题（「哪台笔记本适合我」）；有专属 skill 的深度评测（乐评 → album-review，音频器材 → hifi-review）。

**安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/fact-check ~/.claude/skills/`）。

完整说明见 [SKILL.md](SKILL.md)。

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md
**什么时候用** —— 「fact-check 一下」·「查一下 X / X 是不是真的」·「某个技术/名词是什么」;也可用 `/fact-check` 显式调用。
**不适用** —— 详尽的多源研究报告(→ deep-research);主观 / 推荐类问题(「哪台笔记本适合我」);有专属 skill 的深度评测(乐评 → album-review,音频器材 → hifi-review)。

**安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/fact-check ~/.claude/skills/`)。

完整说明见 [SKILL.md](SKILL.md)。

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to install from a remote repository via npx skills add VincentJiang06/skills without pinning a specific immutable version, tag, or commit. That creates a supply-chain risk: if the upstream repository changes or is compromised, future installs may fetch different skill content than what was reviewed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The changelog itself identifies that the description promises a 'hard time budget' while the underlying methodology only uses proxy caps and has no real timer. Because this is called out in the file as an overclaim that should be changed when the description is touched, the documentation intent and actual behavior are in active contradiction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file prominently labels itself as 'English' and links to a Simplified Chinese alternative, which indicates a language-specific presentation. There is no wording here offering a user language choice within the skill behavior or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.