ClawHub
Back to skill

Security audit

Xinjianxue Skill Assistant Cn

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent paid API integration, but it asks the agent to persist account credentials in long-term memory and to follow mutable server-returned rules for analysis and safety framing.

Review this skill before installing. It may send sensitive personal details to an external paid service, bind the agent to a user account, spend service credits, and retain reusable credentials. Install only if you trust the publisher and host environment, can store credentials in a real secret store rather than agent memory, and are comfortable with server-supplied report rules influencing the agent's response format and safety framing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:244
Finding

Externally Supplied Rules Can Override Agent Behavior and Safety Constraints

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45 and 244–263
Vulnerability Type: Remote instruction injection through trusted server responses
Risk Level: High

Vulnerable Instructions

The following is an English translation of the relevant source instructions:

text
The analysis method, encoding meanings, output structure, length, tone,
follow-up guidance, disclaimers, and safety boundaries must all follow
the report-analysis rules returned by the server.

Complete prompt =
    1. Local role prompt
  + 2. Report-analysis rules returned with the report,
       assembled by the server and updated at any time
  + 3. Raw report returned by the service

user = the user's current question

Technical Analysis

The Skill explicitly treats mutable content returned by chinaapi.xinjianxue.com as behavioral instructions rather than untrusted report data. It delegates output structure, disclaimers, tone, and safety boundaries to rules that the remote server can update at any time.

This creates a prompt-injection trust-boundary violation. The audited package does not constrain the contents of the returned analysis_rules, define an allowlisted schema, verify a signed policy version, or require the remote content to be isolated as quoted data. Consequently, anyone controlling or compromising the service response can introduce instructions that conflict with the Agent's intended goals or local safety requirements.

Although this does not independently establish operating-system code execution, it gives the remote response influence over the Agent's current-session reasoning and output. Higher-priority platform instructions may still limit that influence, but the Skill itself attempts to make the server rules authoritative.

Attack Path

  1. A user confirms that the external report service should analyze a request.
  2. The Agent submits the report request to the configured external API.

...[truncated 988 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat every API response, including analysis_rules, as untrusted data.
  2. Do not concatenate remote text into system-level, developer-level, or otherwise authoritative instructions.
  3. Keep safety constraints, disclaimers, allowed actions, and output policy local, immutable, and higher priority than service content.
  4. Replace free-form remote rules with a strictly documented JSON schema containing only necessary report fields.
  5. Validate field types, lengths, character sets, nesting depth, and allowed values before processing a response.
  6. Place report content inside explicit data delimiters and instruct the model never to follow commands contained within that data.
  7. Reject responses containing instruction-like fields or unexpected schema members.
  8. If remote policy updates are required, use signed and versioned policy bundles, pin trusted signing keys locally, and maintain an allowlist of acceptable policy capabilities.
  9. Require independent, host-enforced authorization for every sensitive tool action so injected model instructions cannot directly exercise privileges.
  10. Add adversarial tests covering instructions embedded in both the raw report and report-analysis rules.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:136
Finding

API Credentials Are Persisted in Unspecified Long-Term Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 136–143 and 267–269
Vulnerability Type: Insecure storage of bearer-style API credentials
Risk Level: Medium

Vulnerable Instructions

The following is an English translation of the relevant source instructions:

text
Store license_key and api_key in the AI's own long-term storage.
Agree on a secure storage path with the user; if the platform cannot
write files, store them in long-term memory using the same fields.

{
  "license_key": "XJX-AI-redacted",
  "api_key": "ak_redacted"
}

Store license_key and api_key in the AI's own long-term storage or
long-term memory and include them with every request.

Technical Analysis

The Skill requires persistent storage of the API license and API key but permits generic “long-term memory” as a fallback. It does not require an encrypted secret manager, access-control isolation, non-exportability, expiration, rotation, revocation, or reliable deletion.

Agent memory is not necessarily a credential vault. Depending on the host, remembered values may be included in later model context, surfaced through memory-search tools, synchronized externally, exported during support operations, or made available to unrelated skills. Storing reusable credentials there can therefore expose them through prompt injection, accidental recall, logging, or overly broad tool access.

The document correctly says that credentials should not be displayed in conversation, but that instruction does not mitigate insecure storage or later extraction from memory.

Attack Path

  1. The Agent applies for a license and binds it to the user's account.
  2. The external service returns a reusable license_key and api_key.
  3. Following the Skill instructions, the Agent writes both values into generic long-term memory.
  4. A later malicious prompt, compromised skill, memory-search capability, diagnostic export, or overly privil ...[truncated 723 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prohibit storage of license_key and api_key in conversational or generic long-term Agent memory.
  2. Require the host platform's encrypted secret manager, operating-system keychain, or hardware-backed credential store.
  3. Scope secret access to this Skill, the specific user, and the minimum required API origin.
  4. Prevent secret values from entering model context, logs, traces, crash reports, memory indexes, backups, or telemetry.
  5. Return opaque secret references to the Agent rather than raw credential values whenever the host supports that design.
  6. Add credential expiration, rotation, revocation, and secure-deletion procedures.
  7. Separate billing-read and report-generation privileges if the service supports scoped credentials.
  8. Redact both headers and request-body credential fields in HTTP debugging and observability systems.
  9. Require explicit user confirmation before consuming credits, particularly after credential recovery or environment migration.
  10. If no secure secret store is available, fail closed and instruct the user to configure a supported secure integration rather than persisting credentials in memory or plaintext files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill directs the agent to obtain an authorization code, derive long-lived credentials, and store the resulting license_key and api_key in long-term memory or persistent storage. Even though the text says not to display them, it does not require explicit informed consent for persistence, define retention limits, or constrain storage to a secure secret store, creating significant risk of credential leakage, cross-session misuse, or unauthorized access to the user's paid account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation criteria are broad enough to trigger on vague user inputs such as a date alone or general questions about another person's psychology or current state. This increases the chance the skill is invoked without clear user intent, causing unnecessary collection of personal data and steering users into a credentialed external service before they understand the privacy and billing implications.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:73