ClawHub
Back to skill

Security audit

XMind Test Case Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an XMind test-case generator, but it uses broad triggers and can fetch full requirement documents, inspect project code, edit a script, and write output to a fixed Desktop path without tight scoping.

Install only if you are comfortable with the agent fetching full requirement documents, reading relevant local project code, modifying the generator script, and writing generated XMind files under ~/Desktop/工作. Prefer invoking it only for explicit XMind test-case generation tasks and confirm the source document and output path before running it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill’s declared purpose is generating XMind test cases from requirement documents, but the finding indicates hidden behavior beyond that scope: hardcoded output and local file writes to a fixed desktop path. Undisclosed filesystem access increases risk because a user invoking a seemingly content-generation skill would not reasonably expect local writes or non-dynamic output behavior.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are broad enough to match common requests like 'write test cases' or 'generate cases,' which can cause the skill to activate unexpectedly. If the skill also performs side effects such as code/file modification or script execution, overbroad activation materially increases the chance of unintended actions in the wrong context.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The natural-language description and operating instructions are entirely in Chinese and present the workflow as fixed behavior, without offering a language choice or stating that Chinese is optional. This can constitute a language/locale policy violation when users have not explicitly opted into Chinese-only interaction.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
该参考文档以自然语言明确规定“必须用英文引号，不能用中文引号”，且整体说明与示例均固定为中文语境，没有说明是否支持其他语言/locale或给出用户选择。按规则，若技能强制特定语言或区域表达而未提供 opt-in，属于语言/locale 政策风险。

Skill Enumeration

Medium
Category
Agent Snooping
Content
# XMind 测试用例生成规范

> 本文件由 SKILL.md 自动生成，请勿手动编辑。
> 修改请编辑 skills/write-cases/SKILL.md，提交时会自动同步。
>
> 本规范适用于所有 AI 编程助手（Claude Code、Cursor、Windsurf、GitHub Copilot 等）。
> 当用户要求"写测试用例"、"生成用例"、"写 XMind 用例"时，严格按照以下规范执行。
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are generic enough that ordinary user requests like '写测试用例' or '生成用例' can activate the skill in contexts the user may not have intended. Because the skill then instructs broad document retrieval and repository inspection, accidental activation can expand data access and cause unnecessary exposure of local or remote project content.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill directs the agent to pull requirement documents from remote sources like Feishu or Confluence but provides no warning, consent step, or data-handling boundary. This creates a real risk of transmitting or processing sensitive internal documentation without the user's informed approval, especially when activation can be triggered by broad phrases.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
This Python file includes multiple user-facing strings in Chinese, such as the sheet title and completion/statistics print messages. Because the script forces a specific language with no opt-in or locale selection, it matches the natural-language locale policy violation criterion.

Static analysis

No suspicious patterns detected.