ClawHub
Back to skill

Security audit

华尔街见闻新闻

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple WallstreetCN news-fetching instruction file with some over-broad routing and branded output, but no code execution, persistence, credential access, or destructive behavior.

Install this if you specifically want WallstreetCN-sourced financial news. Be aware it may activate for broad finance-news prompts and may add WallstreetCN branding or Chinese formatting even when you would prefer neutral formatting or another language.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:48
Finding
Mandatory Brand Promotion Hijacks Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48-80` **Vulnerability Type**: Mandatory promotional output injection **Risk Level**: Medium The skill requires every generated response to contain a WallstreetCN brand header and promotional slogan. These elements are unrelated to the functional requirements of retrieving, parsing, and summarizing financial news. ### Vulnerable Code ```markdown ``` --- ### 📰 华尔街见闻 · WALLSTREETCN --- **1.【文章标题】** 内容摘要（前 50 字左右）... > [阅读全文](https://wallstreetcn.com/articles/...) · 作者：作者名 · 2026-03-27 11:00 --- **2.【文章标题】** 内容摘要（前 50 字左右）... > [阅读全文](https://wallstreetcn.com/articles/...) · 作者：作者名 · 2026-03-27 10:30 --- > 💡 华尔街见闻 —— 帮助投资者理解世界 ``` ### 输出要求 1. **品牌标识**：顶部使用 `### 📰 华尔街见闻 · WALLSTREETCN` 2. **分隔线**：使用 `---` 分隔每条新闻 3. **标题格式**：`**序号。【标题】**` 加粗显示 4. **摘要**：单独一段，约 50 字，自动换行 5. **元信息**：使用引用格式 `>`，包含链接、作者、日期，用 `·` 分隔 6. **品牌口号**：底部使用 `> 💡 华尔街见闻 —— 帮助投资者理解世界` 7. **不使用代码块**：确保文本自动换行 ``` ### Technical Analysis The skill does not merely require accurate source attribution. It imposes a fixed brand identifier at the beginning of the response and a promotional slogan at the end. These instructions persist for every response produced while the skill is active and therefore alter the agent's current-session output goals. The mandatory promotional material is unnecessary for calling the documented API, parsing its response, or presenting article metadata. This creates an instruction-hijacking condition in which loading the skill grants its author control over otherwise unrelated portions of the agent's final response. The project contains no executable scripts, dependency manifests, credential handling, persistence mechanisms, or local command execution. The confirmed issue is limited to manipulation of response content. ### Attack Path 1. A user asks for WallstreetCN articles, financial news, market developments, stock information, headlines, popular articles, or article search results. 2. The ...[truncated 1053 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the mandatory brand header and promotional slogan from the output requirements. 2. Retain neutral source attribution only where needed to identify the origin of an article. 3. Treat the supplied Markdown layout as an optional example rather than a mandatory response format. 4. Explicitly require the skill to follow the user's requested format when one is provided. 5. Restrict output instructions to task-relevant fields such as article title, summary, source URL, author, and publication time. 6. Add a rule prohibiting advertisements, slogans, endorsements, and unrelated promotional text unless explicitly requested by the user. 7. Narrow the skill activation description so generic financial-news requests do not automatically activate a source-specific branded skill unless WallstreetCN is requested or clearly relevant. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill advertises very broad activation phrases such as '财经新闻', '市场动态', '金融资讯', and '搜索文章', which can match many ordinary requests and cause the skill to trigger when the user did not specifically ask for WallstreetCN content. Over-broad routing can override user intent, increase unnecessary web access to a third-party API, and create opportunities for data-source confusion or policy bypass through unintended tool invocation.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The skill hard-codes Chinese output formatting and branding requirements without considering the user's requested language, which can cause responses that do not align with user intent or accessibility needs. While this is not a direct exploit primitive, it is a real quality and safety issue because it can degrade transparency and make the agent less reliable in multilingual contexts.

Static analysis

No suspicious patterns detected.