ClawHub
Back to skill

Security audit

Markdown To Summary

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward markdown summarization skill; the scanner concerns are mostly about bundled QA and documentation files, not hidden runtime behavior.

Install this if you want an agent to summarize markdown you provide. As with any summarization skill, avoid giving it sensitive documents unless you are comfortable with the agent processing that content; the bundled tests and contributor language rules are quality/documentation issues rather than security concerns.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says this skill should be used to summarize markdown or documents in response to user requests like 'summarize this' or 'tl;dr'. However, the code shown contains no summarization logic, no text condensation, and no handling of user-provided markdown content. Its primary purpose is entirely different: it is an automated compliance/test script for a skill repository. It parses SKILL.md frontmatter, enforces documentation conventions, checks for repository files, scans for embedded secrets, and reports pass/fail results. These are materially different capabilities and triggers from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction "Keep SKILL.md body in English" imposes a specific language requirement in natural-language project policy. Under the stated policy rules, forcing a language without user opt-in or a clearly justified locale constraint is a reportable violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This line explicitly requires both SKILL.md content and reference documentation to be in English. That is a natural-language locale restriction, and the file does not present it as optional or justify it as a region-specific necessity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The phrase "Markdown text + summary/condense/tl;dr intent" is broad and underspecified, making it unclear exactly what user inputs will invoke the skill and what similar requests should not. The README does not provide explicit trigger phrases, constraints, or negative examples to prevent overlap with ordinary summarization requests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python test file contains a natural-language policy constraint by requiring README_zh.md to exist. That effectively forces support for a specific locale/language in the skill repository, but the file provides no user choice, opt-in, or documented region-specific justification for this requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This README presents the skill description and usage entirely in Chinese, aside from a link to the English version, which can amount to a locale/language policy constraint without explicit user opt-in. The file does not state that language selection is optional or user-controlled.

Content

No source excerpt is available for this finding.