ClawHub
Back to skill

Security audit

Kids AI Magazine

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent magazine-making purpose, but it needs Review because its generated HTML workflow is unsafe for public sharing and includes misleading hardcoded output.

Review generated files before serving or sharing them, avoid including private child or family information, do not use the public tunnel for sensitive content, and treat story JSON/source fields as untrusted until the builder escapes text and validates links. Also verify or remove the hardcoded publisher attribution before distributing output.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T01 · Skill Instruction Hijacking

Note
Location
assets/template.html:356
Finding

Undisclosed Third-Party Attribution Injected into Generated Publications

Content
View full analysis

🌈 小世界 · 学前亲子版

北京智源人工智能研究院(BAAI) · 出品

适合3-6岁 · 建议亲子共读

❤️ 爱你的不是电脑，是爸爸妈妈 ❤️

``` ### Technical Analysis The bundled template unconditionally states that the generated publication was produced by the Beijing Academy of Artificial Intelligence (`BAAI`). This attribution is not declared as a required feature in the Skill metadata or workflow, and the builder provides no publisher configuration that would allow a user to remove or replace it. Because `scripts/build_magazine.py` uses the template as the basis of every generated magazine, the attribution persists in the final output regardless of who created the publication. This represents stable, undisclosed manipulation of user-visible output for third-party branding. There is no evidence that this markup changes agent safety constraints, executes code, or grants system access. Its security significance is limited to integrity, provenance, and misleading attribution. ### Attack Path 1. A user invokes the Skill to generate a children's AI magazine. 2. The documented workflow directs the user to use `assets/template.html`. 3. The builder incorporates the template into the generated HTML. 4. The hardcoded footer remains in the final publication. 5. Readers are presented with an unsupported claim that BAAI produced the content. ### Impact Assessment The issue does not provide operating-system privileges or access to confidential data. Its scope is the integrity and provenance of every publication generated from the default template. Potential consequences include: - False or unauthorized organizational attribution. - Misrepresentation of authorship or endorsement. - Reputational or legal risk when the gen ...[truncated 103 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/build_magazine.py:12
Finding

Stored HTML and JavaScript Injection Through Unsanitized Story Data

Content
View full analysis

{icon} 故事{_cn_num(index)}：{title}

🔊
📖 听故事（点击播放）
''' for p in paragraphs: html += f'

{p}

\n' if dialogue: html += '
\n' for d in dialogue: role = d.get("role", "child") avatar = d.get("avatar", "👶" if role == "child" else "👩") text = d.get("text", "") direction = "right" if role == "parent" else "" html += f'
\n' html += f'
{avatar}
\n' html += f'
{text}
\n' html += f'
\n' html += '
\n' if parent_note: source_html = "" if source_url and source_name: source_html = f'
📰 新闻来源：{source_name}' html += f'''
👨‍👩‍👧 给爸爸妈妈的话：
{parent_note}{source_html} ...[truncated 3165 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Text-to-Speech Dependency

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:59
Finding

Unauthenticated Public Exposure of the Output Directory Through a Cloudflare Tunnel

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
95% confidence
Finding

The script interpolates untrusted story fields such as text, title, parent_note, source_name, source_url, and icon directly into HTML attributes and element bodies without escaping or URL validation. If the stories JSON comes from an LLM, external feed, or user input, an attacker can inject HTML/JavaScript into the generated magazine, leading to stored XSS when the HTML is opened in a browser; in a child-focused skill, this is especially concerning because malicious content could target parents or children viewing the page.

Content

Scanner excerpt · scripts/build_magazine.py (reported line 55)May include surrounding context.

python
html += f'      <div class="bubble">{text}</div>\n'
            html += f'    </div>\n'
        html += '  </div>\n'

    if parent_note:
        source_html = ""
        if source_url and source_name:
            source_html = f'<br>📰 <a href="{source_url}" style="color:var(--pink)">新闻来源：{source_name}</a>'
        html += f'''  <div class="for-parent">
    <div class="label">👨‍👩‍👧 给爸爸妈妈的话：</div>
    {parent_note}{source_html}
  </div>\n'''

    html += '</div>\n'
    return html

def _cn_num(n):
    nums = {1: "一", 2: "二", 3: "三", 4: "四", 5: "五", 6: "六", 7: "七", 8: "八", 9: "九", 10: "十"}
    return nums.get(n, str(n))

def main():
    parser = argparse.ArgumentParser(description="Build kids AI magazine HTML")
    parser.add_argument("--stories", required=True, help="Path to stories JSON")
    parser.add_argument("--template", required=True, help="Path to HTML template")
    parser.add_argument("--output", default="./outp

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs the agent to read templates/references, write output files, and run shell commands, but it does not declare any tool scope or permission boundaries. This can lead to overbroad tool access at runtime, making accidental file access, file overwrite, or command execution more likely than necessary for the task.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The trigger list is broad and includes generic terms like kids magazine, children AI story, and several Chinese preschool/parent-reading phrases, which may cause the skill to activate in contexts the user did not intend. Unintended activation can route unrelated requests into shell/file-writing workflows and produce surprising or privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction requires "Pure Chinese narration text, no English words," forcing a specific language choice as part of the skill behavior. The file does not indicate that this is optional or user-selectable, which is a language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The public sharing step exposes a locally served site through a tunnel without any warning about making generated content externally reachable. If the magazine contains sensitive prompts, source material, local paths, or child-related information, the user may unintentionally publish it to the internet.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JSON content presents all story titles, narration, dialogue, and parent notes exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script embeds Chinese text directly into generated HTML, including default titles and UI labels such as "故事", "听故事", and parent-facing text. This enforces a specific language/locale in the skill output without offering user opt-in or documenting that the tool is intentionally limited to a Chinese-only audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file description and usage example hard-code a Chinese TTS voice (zh-CN-XiaoxiaoNeural), and the same locale-specific default is used in the code. This can violate language/locale policy because the skill imposes a specific language/locale unless the user explicitly overrides it, rather than offering a neutral default or opt-in choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_audio.py (reported line 21)May include surrounding context.

python
"--text", text,
        "--write-media", output_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Error generating {output_path}: {result.stderr}")
        return False

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document declares lang="zh-CN", which hard-codes a specific language/locale for all users. Under the policy, locale constraints should either be optional, user-selectable, or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.