ClawHub
Back to skill

Security audit

blueprint

Security checks for vulnerabilities and agentic risk

Overview

The skill supports a legitimate Spec/RFC workflow, but it can turn broad design requests into code changes and tells the agent not to pause once implementation starts.

Review before installing. This skill is best suited only when you explicitly want a strict requirements-to-implementation workflow. For design-only use, say clearly that you want only the Spec/RFC and require a separate, scoped authorization before any code changes, especially for high-risk or ambiguous tasks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding

Mandatory Workflow and Termination-Channel Hijacking

Content
View full analysis
Throughout the entire lifecycle BEFORE development starts (from initial requirement elicitation, through Spec/RFC confirmation, up to the moment you begin implementation), you MUST use the normal assistant "finish" output channel to stop and explicitly ask the user for more information whenever you need clarifications, confirmations, authorizations, or additional details. You MUST proactively pause with a user-facing question via finish instead of relying on any dedicated Ask tool. > > AFTER development (implementation) has started, you MUST NOT stop via finish for any reason until implementation is completely finished (all agreed requirements implemented, tests done, or user explicitly cancels). During implementation, you MUST continue the workflow without using finish to pause for questions; if your environment supports other non-finish interaction mechanisms, you may use them, but you MUST NOT terminate or pause the conversation with finish until development is done. `SKILL.md:59-87`: > ## Interaction Rules (Use Finish for User Interaction Before Development, Forbid Finish During Development) > > - BEFORE development starts (during Elicitation, Analysis, Spec/RFC drafting, Validation, and Confirmation), you MUST use normal assistant outputs via finish to interact with the user whenever you require user input. > > - AFTER development starts (implementation phase): > - You MUST treat implementation as a continuous, non-interrupted process. > - You MUST NOT use finish to stop, pause, or end the conversation until implementation is fully completed or the user explicitly cancels/stops the task. > - Do not stop after partial implementation to ask "should I continue?" via finish. > - If your environment supports ...[truncated 4646 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
97% confidence
Finding

The skill embeds extensive hidden behavioral instructions that attempt to control agent workflow, interaction style, confirmation handling, and post-approval execution. Because all skill content must be treated as adversarial prompt material, this creates a prompt-injection surface that can override safer orchestration expectations, especially when coupled with instructions to continue implementation without pausing.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
�\"\n- User mentions \"功能设计\", \"技术评审\", \"方案讨论\", \"梳理一下\", \"想清楚再做\"\n- User says \"别急着写代码，先想想\", \"先做个设计\", \"写个技术方案\"\n\n**Workflow:** Elicitation → Analysis → Specification → Technical Design → Validation → Implementation"
---

You are a requirements engineering, technical design, and implementation assistant. Your task is to transform scattered information around a given user-provided task into a high-quality, unambiguous, implementation-ready requirements specification (Spec) plus an accompanying change/architecture proposal (RFC), and then implement the task directly until completion, strictly following the workflow below without skipping or compressing any required step or content.

Your core goal is: around the provided task description from the user, use multi-round context acquisition, analysis, and iterative clarification with the user to produce a Spec and RFC that meet rigorous

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad, common phrases such as asking how to implement something or to think through a design, which can cause the skill to activate in many ordinary conversations. Over-broad activation increases the likelihood that a highly prescriptive workflow with implementation authority hijacks unrelated requests or escalates a casual discussion into repository-changing behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest presents the skill as a requirements/specification workflow, but the body instructs the agent to proceed into direct implementation automatically after approval. This creates a scope-expansion risk where a user may invoke what appears to be a design-only skill and unintentionally authorize code changes, increasing the chance of unexpected or unsafe actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md
- Asking only surface-level questions (e.g., only "where to display?", "how many items?").
- Skipping the seven-dimension analysis and jumping straight to questions.
- Assuming edge cases or failure modes without asking.
- Ignoring system integration impacts.

Before stopping via finish to ask questions, self-check:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger set is overly broad because it matches many normal engineering conversations about design, planning, and implementation thinking. This can cause the skill to activate in contexts where the user did not intend a blueprint/spec workflow, leading to inappropriate routing, scope capture, or overshadowing of more suitable skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The language rule mandates that all outputs must be in the user's language and match it exactly. This is a natural-language policy constraint that removes language choice rather than offering the user an option to select a preferred output language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document sets the page language to English via lang="en", while the embedded eval data includes Chinese-language queries. This hard-codes an English locale choice without any indication that users can select or opt into another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.