ClawHub
Back to skill

Security audit

Marketing Strategy Domain

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent marketing reference package, but it tells the agent to automatically install and load an unpinned external skill when activated.

Review before installing. The marketing content itself appears benign, but install only if you trust the universal-task-os dependency resolution path; ideally require manual approval, a known publisher, and a pinned version before allowing the dependency to be installed or loaded.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:27
Finding

Automatic Installation of an Unpinned External Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–35
Vulnerability Type: Supply-chain risk caused by automatic installation of an unverified dependency
Risk Level: High

Vulnerable Code Snippet

markdown
## Dependency Declaration

This skill strongly depends on Universal Task OS (`universal-task-os`). Without UTOS, this skill only supports reference lookup and cannot perform marketing analysis tasks.

Loading check process (executed every time the skill is activated):

1. Detect whether the `universal-task-os` skill is installed.
2. If it is not installed, automatically install the `universal-task-os` skill.
3. If installation succeeds, load UTOS and execute according to this skill's usage rules.
4. If installation fails, downgrade to read-only reference mode.

Technical Analysis

The activation workflow directs the agent to install and load an external skill automatically when universal-task-os is absent. The dependency declaration does not specify:

  • An authoritative registry or repository
  • A verified publisher identity
  • An immutable version or commit
  • A cryptographic checksum or signature
  • A dependency review policy
  • Explicit user approval before installation and loading

Consequently, the content executed by the agent is not fully represented by the audited project. Package-name ambiguity, dependency confusion, registry compromise, publisher compromise, or a malicious future release could cause an unintended implementation of universal-task-os to be installed.

The risk is amplified because successful installation is immediately followed by loading the dependency. This creates a direct path from dependency resolution to execution of third-party skill instructions without an intervening integrity check or approval boundary.

No malicious implementation of universal-task-os is included in the audited project, so exploitation depends on the external package source or resolution mechanism being compromised or un ...[truncated 1704 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic dependency installation from the activation workflow.
  2. When the dependency is missing, remain in the documented read-only mode and ask the user for explicit approval before any installation.
  3. Identify one authoritative repository or registry and reject dependencies resolved from any other source.
  4. Pin universal-task-os to an immutable version or commit identifier.
  5. Record and verify a cryptographic checksum or trusted publisher signature before installation.
  6. Audit the exact pinned dependency version and its transitive dependencies before allowing it to load.
  7. Separate installation from activation so that successful installation does not automatically authorize execution.
  8. Display the dependency source, publisher, version, requested capabilities, and integrity result in the approval prompt.
  9. Restrict the dependency to the minimum required tools, filesystem paths, network destinations, and data.
  10. Fail closed when identity or integrity verification cannot be completed, preserving only safe reference lookup functionality.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the system to automatically install a dependency (universal-task-os) whenever it is missing, without requiring an explicit user consent step. Automatic dependency installation expands the trusted computing base and can introduce supply-chain risk, unexpected capability escalation, or execution of unreviewed code or prompts from another skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description lists generic activation terms such as “品牌营销”, “市场分析”, and “营销策略”, which are broad topics rather than narrowly scoped invocation phrases. The file does not provide exclusion conditions or negative examples, so ordinary discussion about marketing could unintentionally activate this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The description and operating instructions are entirely in Chinese, effectively imposing a specific language for interaction and comprehension. The file does not offer alternative language support, user opt-in, or a documented business or compliance reason for restricting the skill to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file presents all instructions and requirements in a single language, which can constitute a language/locale policy issue when no user opt-in or alternative language option is provided. The document does not indicate that it is intentionally region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file uses Chinese throughout, including the title, instructions, and user guidance, but does not indicate that the skill is region-specific or that users may opt into another language. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The document presents all instructions and task descriptions exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can create a language/locale policy issue because it implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.