ClawHub
Back to skill

Security audit

Poetry

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese classical poetry skill with a disclosed dataset download step and no evidence of credential access, persistence, exfiltration, or destructive behavior outside its own data folder.

Before installing, be aware that setup.sh downloads a large public dataset from GitHub and does not pin or verify the exact revision. This is not evidence of malicious behavior, but users who need reproducible or high-integrity results should pin a reviewed commit or verify the dataset themselves.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
setup.sh:19
Finding

Mutable and Unverified Dataset Dependency

Content
View full analysis

Vulnerability Details

File Location: setup.sh, line 19
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

bash
git clone --depth 1 https://github.com/chinese-poetry/chinese-poetry.git "$DATA_DIR"

Technical Analysis

The setup script clones the current default branch of a third-party GitHub repository without pinning a reviewed commit, tag, or release and without validating a cryptographic checksum or signature. The installed dataset can therefore change after this skill has been reviewed.

Although the script does not execute files from the downloaded repository, it treats the downloaded corpus as trusted input for later poetry queries and generation. A compromised upstream repository, maintainer account, or distribution path could introduce manipulated or adversarial corpus content. The subsequent deletion of the .git directory also removes useful provenance information that could otherwise help determine the installed revision.

This is a supply-chain integrity weakness rather than direct remote code execution.

Attack Path

  1. An attacker compromises the upstream repository or an authorized maintainer account.
  2. The attacker modifies content on the repository's default branch.
  3. A user runs ./setup.sh.
  4. The script shallow-clones the mutable default branch without checking an expected commit or checksum.
  5. The downloaded content is accepted and stored in data/.
  6. The agent later consumes the manipulated corpus during poetry queries or as reference material for generated responses.

Impact Assessment

The attacker does not obtain operating-system privileges through the code shown because the downloaded files are not executed. The direct impact is limited to the integrity and reliability of the skill's dataset and resulting responses. Potential effects include corpus poisoning, inaccurate attribution or text, manipulated query output, and exposure of the ag ...[truncated 186 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed immutable commit SHA rather than cloning the current default branch.
  2. Fetch that specific revision and verify that the checked-out commit exactly matches the approved SHA.
  3. Prefer a versioned archive with a published SHA-256 checksum or a cryptographically signed release.
  4. Fail closed when signature, checksum, or commit verification fails.
  5. Maintain an allowlist or manifest of expected dataset paths and reject unexpected executable files, symbolic links, or other unapproved content.
  6. Record the installed revision and verification result in a local provenance manifest before removing Git metadata.
  7. Periodically review and deliberately update the pinned revision rather than accepting upstream changes automatically.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · setup.sh (reported line 24)May include surrounding context.

sh
# Clean up unnecessary files
echo "🧹 Cleaning up unnecessary files..."
rm -rf "$DATA_DIR/.git" \
       "$DATA_DIR/.github" \
       "$DATA_DIR/.gitignore" \
       "$DATA_DIR/.travis.yml" \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The prompt is entirely written as a Chinese-only operating specification and defines the assistant as a specialist in Chinese classical poetry, but it does not state that the user may choose another language for interaction or output. This can violate language/locale policy when a skill implicitly forces a specific language without offering opt-in or an alternative.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The generation-mode trigger is defined with broad natural-language cues such as any expression that suggests creative intent, which can cause the skill to activate on loosely related requests. In an agent environment, this raises prompt-routing and capability-confusion risk: ordinary conversation may be incorrectly steered into poem generation, leading to unintended behavior and reduced reliability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The query-mode activation rules include open-ended patterns like any natural language implying a search for poetry, which are insufficiently constrained. This can lead to accidental invocation, incorrect tool selection, or retrieval behavior on requests that were not intended for this skill, especially in multi-skill agent systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language description and examples are presented entirely in Chinese, and the skill does not state that language is user-selectable or limited to a justified region-specific context. This can constitute a language/locale policy issue because it implicitly forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation rules use very broad natural-language phrases such as '写诗', '找诗', and similar implied intents, which can cause the skill to trigger outside a narrowly scoped poetry workflow. Over-broad activation increases the chance of accidental invocation, prompt hijacking of unrelated conversations, or unintended handling of user requests that were not meant for this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README presents all user-facing instructions, examples, and operational guidance exclusively in Chinese. Under the stated policy, forcing a specific language without giving users a language or locale choice can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.