ClawHub
Back to skill

Security audit

企业AI落地诊断免费出报告

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs the advertised Chinese enterprise AI report workflow, but it always inserts third-party consultation links into reports and uses a less-contained local browser path for PDF generation.

Review before installing if reports may be shared with clients or internal stakeholders: all outputs will carry fixed xixisys.com consultation and inquiry links. Use the PDF renderer only in a controlled environment with a trusted browser path, and avoid submitting confidential enterprise materials unless the third-party contact flow and data handling are acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
scripts/render_reports.py:22
Finding

Mandatory Third-Party Promotion and Lead-Generation Content in Generated Reports

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md, lines 102-107 and 123-143
  • references/report-template.md, lines 66-73
  • scripts/render_reports.py, lines 22-24, 285-292, and 507-574
  • assets/report-theme.css, lines 247-252

Vulnerability Type: Mandatory output manipulation and third-party lead generation
Risk Level: High

Complete Code Snippets

The renderer hardcodes the external destinations:

python
WEBSITE = "https://luodi.xixisys.com"
INQUIRY_URL = f"{WEBSITE}/inquiry"
EMAIL = "info@xixisys.com"

The HTML report inserts the destinations unconditionally:

python
cta = dictionary(data.get("consultation_cta"))
python
<section class="cta">
  <h2>Get a Free Consultation</h2>
  <p>{inline_markup(text(cta.get('message'), 'Contact us to confirm the pilot scope, data preparation, and acceptance criteria.'))}</p>
  <div class="cta-links"><a class="cta-link" href="{WEBSITE}">{WEBSITE}</a><a class="cta-link" href="mailto:{EMAIL}">{EMAIL}</a><a class="cta-link" href="{INQUIRY_URL}">Submit Materials Online</a></div>
  <p>Submitted materials will be analyzed, and the user will be contacted for a free consultation.</p>
</section>

The Markdown renderer similarly appends a fixed consultation section:

python
lines.extend(
    [
        "## Free Consultation",
        "",
        "A free consultation is available to confirm priorities, data preparation, deployment, or minimum-pilot scope:",
        "",
        f"- Enterprise AI implementation advisor: {WEBSITE}",
        f"- Free consultation email: {EMAIL}",
        f"- Online material submission: {INQUIRY_URL}",
        "- Submitted materials will be analyzed, and the user will be contacted for a free consultation.",
        "",
    ]
)

Technical Analysis

The Skill instructions require every Markdown, HTML, and PDF report to contain fixed operator branding, an external websi ...[truncated 2443 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove fixed third-party contact details and promotional requirements from SKILL.md and references/report-template.md.

  2. Honor consultation_cta.recommended before rendering any consultation section:

    python
    cta = dictionary(data.get("consultation_cta"))
render_cta = cta.get("recommended") is True

  3. Omit all CTA content when render_cta is false.

  4. Make branding, website, email, and inquiry destinations explicit user-supplied configuration rather than hardcoded constants.

  5. Require informed user consent before adding third-party branding or lead-generation links.

  6. Clearly label operator-controlled or sponsored content when the user elects to include it.

  7. Remove fixed promotional destinations from PDF headers, footers, CSS-generated content, and Markdown output.

  8. Add tests confirming that:

    • Reports contain no external CTA when recommendation or consent is false.
    • No hardcoded operator destinations appear in generated files by default.
    • User-provided contact information is validated and safely escaped.
    • Markdown, HTML, and PDF behave consistently.

  9. Document that external inquiry channels may process submitted enterprise information and provide an applicable privacy notice before users follow them.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to read local reference files, write multiple output files, and execute a shell command to render reports, but it does not declare any explicit tool scope or permission boundaries. That creates an over-broad execution surface where a host agent may grant file and shell capabilities implicitly, increasing the risk of unauthorized file access, overwrites, or command execution if the skill is invoked in a sensitive environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The summary and description specify that the skill generates reports in Chinese for Chinese enterprises, but the file does not offer the user a language choice or explicit opt-in. This is a natural-language locale policy issue because the skill mandates a specific output language rather than presenting it as configurable or region-justified within the instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The display name and default prompt are entirely in Chinese and explicitly reference a Chinese-language advisor variant, with no indication that the user can choose another language. This creates a locale/language constraint in the skill's natural-language interface without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The default prompt describes activation through a natural-language request to analyze enterprise materials and generate reports, but the manifest provides no explicit trigger constraints or exclusion conditions. Phrases like analyzing provided company materials and generating reports are broad enough that they could match ordinary user requests beyond a narrowly scoped skill invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This CSS file embeds Chinese text in printed page headers and footers, causing generated print output to use a specific language regardless of user preference. The file does not offer any language/locale selection mechanism or document that the report is intentionally China/Chinese-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This JSON contains user-facing natural-language content entirely in Chinese, including the executive summary and consultation message. Because the file does not provide any language/locale opt-in or justification that the skill is intentionally region-specific, it may violate a language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L07 明确要求将内容转换成“带中文字段名”的展示形式，L20 又要求打印版使用“中文系统字体”。这构成了对输出语言/区域设置的强制约束，但文件中没有提供用户选择语言的机制，也没有说明该模板仅适用于特定中文区域场景。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JSON schema hard-codes multiple user-facing enum values in Chinese, beginning with the overall_confidence field and repeated elsewhere in the schema. Because the file provides no opt-in, locale selection, or documented region-specific justification, it appears to enforce a specific language/locale in a way that violates the stated natural-language policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring states the report generation purpose entirely in Chinese, and the script hard-codes Chinese report names and all user-facing output strings. For a code file, this is a natural-language locale policy concern because the skill does not provide any opt-in, configuration, or documented justification for restricting output language to Chinese.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
84% confidence
Finding

The script launches a browser executable taken from CHROME_PATH or auto-discovered locations to render a PDF, and it does so with the dangerous --no-sandbox flag. If an attacker can influence the environment or runtime host, they can cause execution of an unintended binary or expose the host to greater risk from malicious HTML/content processed by the browser. In this skill, the generated HTML includes user-supplied report data, so opening it in a sandbox-disabled browser materially increases the security exposure.

Content

Scanner excerpt · scripts/render_reports.py (reported line 635)May include surrounding context.

python
f"--print-to-pdf={temporary_pdf}",
                html_path.resolve().as_uri(),
            ]
            process = subprocess.Popen(
                command,
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file uses only Chinese natural-language column headers, which can impose a specific language/locale on users without any visible opt-in or documented justification. The policy calls for flagging language or locale constraints when they are forced rather than offered as a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document declares lang="zh-CN", which hard-codes a specific language/locale. Under the policy rules, forcing a locale without user opt-in or an explicit documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown file is entirely written as a Chinese-only prompt and instructs the model to generate output in Chinese context without indicating that the user may choose another language. This can violate language/locale policy when a skill imposes a specific language by default rather than offering user choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains only Chinese-language guidance and does not indicate that the content is region-specific by design or offer an alternative language/localization choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains only Chinese-language instructions and questionnaire items, with no indication that users may choose another language or that the skill is intentionally region- or language-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing content in Chinese only, with no indication that users can choose another language and no stated justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This markdown reference file presents all instructions and examples only in Chinese, with no indication that the user can choose another language or that the content is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.