ClawHub
Back to skill

Security audit

Diagram Workflow Method

Security checks for vulnerabilities and agentic risk

Overview

This is a diagramming-method skill that provides SVG and Mermaid templates without hidden privileged behavior.

Install this skill if you want Chinese-language guidance for producing SVG or Mermaid diagrams. Review generated diagrams for factual accuracy and redact sensitive system details before sharing them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md
</marker>
  </defs>
  <text x="340" y="28" text-anchor="middle" font-size="16" font-weight="bold" fill="#1a1a2e">系统架构图</text>
  <!-- 前端层 -->
  <rect x="40" y="50" width="600" height="70" rx="8" fill="#e8f4f8" stroke="#4a90d9" stroke-width="1.5"/>
  <text x="60" y="75" font-size="12" fill="#555">前端层</text>
  <rect x="80" y="80" width="120" height="30" rx="5" fill="#4a90d9"/>

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes broad English terms like 'draw', 'diagram', 'flowchart', and 'architecture', which can cause unintended activation in unrelated conversations. Overbroad activation expands the attack surface by making it easier for adversarial or irrelevant prompts to invoke the skill unexpectedly, potentially overriding more suitable routing or causing untrusted content to be transformed into rendered SVG/Mermaid output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest description and the full skill content are written in Chinese, and there is no natural-language instruction offering users a choice of output language or clarifying that the locale is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in can be a language or locale policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description states '8种图表类型' and enumerates architecture/flow/sequence/state/ER/topology/data-flow, implying a bounded eight-type method. However, the file later documents Mermaid support for additional types such as Gantt, Pie Chart, and Mindmap, expanding the advertised behavior beyond the declared scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes the skill as a general-purpose diagramming method '不绑定任何特定领域'. Yet the body contains domain-specific guidance such as microservice architecture patterns, API Gateway-centered layouts, Kubernetes/cloud infrastructure examples, and network-security elements like DMZ and firewalls, which go beyond a purely domain-agnostic method.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

Line L232 instructs that template placeholders are user-provided content and '不可AI编造'. Elsewhere, the document presents complete example diagrams populated with concrete entities and relationships, which is not inherently unsafe but does dilute the stated non-fabrication rule and creates intent ambiguity about when synthesized example content is acceptable.

Content

No source excerpt is available for this finding.