ClawHub
Back to skill

Security audit

Schema Markup

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent schema-markup guide, but users should review it because it recommends an unsafe React JSON-LD pattern and mutable remote install commands.

Review before installing. Prefer a pinned installer or reviewed commit, avoid global installation unless needed, and do not copy the React JsonLd component as written for any schema data that may come from users, CMS fields, products, reviews, or databases; use an HTML-safe JSON serializer or escape <, >, &, U+2028, and U+2029 before embedding JSON-LD.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party Code Execution Through Installation Commands

Content
View full analysis
Remediation
View remediation
/skills/writing/schema-markup ``` 3. Publish and verify package integrity hashes or signed release attestations. 4. Use lockfiles where the installation mechanism supports them. 5. Review package lifecycle scripts and CLI entry points before recommending execution. 6. Keep installation instructions synchronized across `README.md` and `SKILL.md`. 7. Advise users not to run installation commands with elevated privileges. 8. In CI/CD environments, execute installation in a restricted container with limited credentials, filesystem access, and network permissions. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:143
Finding

JSON-LD Script-Breakout Injection in Recommended React Component

Content
View full analysis
}) { return ( ` terminates the script element even when it appears inside a JSON string and even when the script has the non-executable `application/ld+json` MIME type. If any property in `data` originates from an untrusted CMS field, product record, profile, review, URL parameter, or other attacker-influenced source, an attacker can supply a value such as: ```text ``` After serialization and insertion through `dangerouslySetInnerHTML`, the browser can close the JSON-LD element and parse the injected markup as a new executable script element. React's normal text escaping does not protect this implementation because `dangerouslySetInnerHTML` explicitly bypasses that mechanism. ### Attack Path 1. An application adopts the documented `JsonLd` component. 2. A schema property is populated from attacker-controlled or insufficiently validated content, such as a product name, author biography, review, or CMS description. 3. The attacker stores or submits a payload containing a closing `` sequence followed by executable HTML or JavaScript. 4. The server calls `JSON.stringify(data)`, which preserves the dangerous `<` char ...[truncated 1066 chars]
Remediation
View remediation
): string { return JSON.stringify(data) .replace(//g, '\\u003e') .replace(/&/g, '\\u0026') .replace(/\u2028/g, '\\u2028') .replace(/\u2029/g, '\\u2029'); } export function JsonLd({ data }: { data: Record }) { return ( ``` The rendered HTML must not contain a literal attacker-controlled closing script tag. 6. Deploy a restrictive Content Security Policy using nonces or hashes and disallow unrestricted inline scripts as defense in depth. 7. Update both `SKILL.md` and `references/schema-examples.md` so users are not directed to copy the vulnerable pattern. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
Findings (11)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
return (
    <script
      type="application/ld+json"
      dangerouslySetInnerHTML={{ __html: JSON.stringify(data) }}
    />
  );
}

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
## Testing Checklist

- [ ] Validates in Rich Results Test with no errors
- [ ] No warnings for recommended properties
- [ ] Schema content matches visible page content
- [ ] All required properties included for each type
- [ ] URLs are fully qualified

Unvalidated Output Injection

High
Category
Output Handling
Confidence
91% confidence
Finding

The React example renders a script tag using dangerouslySetInnerHTML with data that may be dynamically derived from application content. Although JSON.stringify helps serialize the object, embedding raw JSON into a script block can still enable script-breakout/XSS if attacker-controlled values contain sequences such as , because the HTML parser terminates the script element before JavaScript parsing occurs.

Content

Scanner excerpt · references/schema-examples.md (reported line 628)May include surrounding context.

md
return (
    <script
      type="application/ld+json"
      dangerouslySetInnerHTML={{ __html: JSON.stringify(data) }}
    />
  );
}

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The README explicitly instructs users to copy the skill into persistent local or global skill directories, causing the capability to be automatically available in future sessions. While this appears benign and expected for a skill installer, persistence increases blast radius if the skill were later modified maliciously or if users install unreviewed content from the referenced source.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/writing/schema-markup .cursor/skills/schema-markup

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/writing/schema-markup .claude/skills/schema-markup

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/writing/schema-markup ~/.claude/skills/schema-markup

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: schema-markup
model: fast
version: 1.0.0
description: >
  Add, fix, or optimize schema markup and structured data. Use when the user mentions

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package at runtime rather than a pinned, reviewed version. If the package is compromised upstream or a malicious version is published, users following the skill instructions could execute untrusted code on their machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The example sets "availableLanguage": ["English"], which expresses a fixed language choice in natural-language content. Because the document is a generic schema examples guide rather than a clearly region-specific or English-only tool, this can be read as prescribing a single language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.