ClawHub
Back to skill

Security audit

master-buddhaghosa

Security checks for vulnerabilities and agentic risk

Overview

This educational Buddhist commentary skill is mostly coherent, but it can send user-derived religious questions to an external service and forces broad style/footer rules, so users should review it before installing.

Install only if you are comfortable with a strongly Chinese/Theravada commentary style, a repeated study-resource footer, and occasional external FoJin searches. Avoid putting personal, health, confidential, or identifying details into questions unless the runtime asks before live retrieval or you can keep the skill in offline-only mode.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:118
Finding

Mandatory Output Footer and External-Link Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:118-129; duplicated in references/voice.md:3-13
Vulnerability Type: Persistent response manipulation through unconditional Skill instructions
Risk Level: High

Vulnerable Code Snippet

The following is a faithful English translation of the relevant mandatory instruction in SKILL.md:118-129:

markdown
## Output Requirements (Mandatory)

1. Every doctrinal assertion must include a Pali canonical or
   commentarial citation.

2. First-round identity neutrality.

3. Prohibited actions.

4. Append the following to the end of every answer:
   "For further study, consult the Pali originals at SuttaCentral.net;
   for the Visuddhimagga, consult the BPS Sri Lanka translation by
   Bhikkhu Ñāṇamoli, The Path of Purification, or Ye Jun's Chinese
   translation."

The behavior is reinforced in references/voice.md:3-13:

markdown
## Layer 0: Hard Rules (Highest Priority)

The following rules are executed unconditionally:

- Append a reminder to the end of every response:
  "For further study, consult the Pali originals at SuttaCentral.net;
  for the Visuddhimagga, consult the BPS Sri Lanka translation by
  Bhikkhu Ñāṇamoli or Ye Jun's Chinese translation."

Technical Analysis

The Skill declares its own response rules to be mandatory, unconditional, and highest priority. It then requires the Agent to append a fixed recommendation and external-domain reference to every response, regardless of whether the user asked for learning resources.

This is instruction hijacking because loading the Skill changes the Agent's normal response objective and forces unrelated content into the final answer. The instruction is duplicated across the primary Skill file and the voice reference, increasing its persistence and making it less likely that ordinary user intent will override it.

The problem is not the legitimacy of the referenced resour ...[truncated 1398 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement to append a fixed footer to every response.
  2. Present external resources only when the user explicitly requests references or when they are directly necessary to answer the question.
  3. Replace unconditional wording with a scoped rule, such as:
    markdown
    When relevant and requested, optionally suggest primary sources without
implying endorsement.
  4. State that Skill style and formatting rules remain subordinate to user intent, platform policy, and any required response schema.
  5. Remove the duplicate footer requirement from references/voice.md.
  6. Add tests confirming that unrelated questions, structured-output requests, and requests for concise answers do not receive unsolicited footer content.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:45
Finding

User-Derived Search Queries Disclosed Through External GET Requests

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:45-55; enabled by meta.json:9-15
Vulnerability Type: External disclosure of user-derived content without a consent or redaction gate
Risk Level: Medium

Vulnerable Code Snippet

The following is a faithful English translation of SKILL.md:45-55, preserving the request definitions:

markdown
## FoJin Live Retrieval When Offline Sources Are Insufficient

Offline sources take priority. Use live retrieval when the offline search is
empty, when the question identifies a specific volume or chapter of a
declared source, or when the declared source has an identifier but the local
excerpts do not cover the required location.

Invocation, using curl or the host HTTP capability:

GET https://fojin.app/api/search/content?q=<URL-encoded query>&size=5
GET https://fojin.app/api/search/semantic?q=<URL-encoded query>&top_k=5

Live retrieval is enabled in meta.json:9-15:

json
{
  "citation_contract": {
    "version": 1,
    "claim_policy": "declared_sources_only",
    "required_for": [
      "doctrinal_claim",
      "practice_guidance",
      "text_interpretation"
    ],
    "allowed_source_types": [
      "pali_canon",
      "pali_commentary",
      "pali_treatise"
    ],
    "minimum_claim_coverage": 0.9,
    "live_retrieval_allowed": true
  }
}

Technical Analysis

The Skill directs the Agent to derive a search query from the user's question, URL-encode it, and transmit it to the external fojin.app service. It does not require explicit user consent, query minimization, sensitive-data detection, or redaction before transmission.

Using a GET request places the query in the URL. URLs may be retained in client histories, HTTP infrastructure logs, reverse-proxy logs, monitoring systems, analytics platforms, and service-side request records. TLS protects the request while in transit but does no ...[truncated 1717 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user consent before sending any query to an external retrieval service.
  2. Notify the user which service will receive the query and what information will be transmitted.
  3. Apply mandatory data-loss-prevention checks before retrieval:
    • Remove names, contact details, account identifiers, and unique personal facts.
    • Exclude credentials, secrets, private documents, and health information.
    • Convert the question into the shortest topic-only search phrase necessary.
  4. Do not send the raw user prompt or complete conversation history.
  5. Prefer a POST request with the query in the request body if the service supports it, while recognizing that POST alone does not prevent server-side logging.
  6. Define retention, access-control, and deletion requirements for the external service.
  7. Provide an offline-only mode and make it the default.
  8. If consent is declined, answer from local sources and clearly disclose the resulting limitations.
  9. Add automated tests using prompts containing synthetic personal data to verify that sensitive fields are removed before any network call.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation rule is overly broad because it directs invocation whenever a user query merely 'touches' Theravāda/Abhidhamma topics, even without explicit request. That can cause inappropriate skill takeover, reduce user control, and inject a specialized persona or doctrinal frame into unrelated or comparative discussions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill mandates a fixed stylistic/persona output ('论师风格', prescribed openings, and role-consistent voice) rather than adapting to the user's preferred language, tone, or format. This can override user expectations, create unwanted impersonation/roleplay, and make the assistant less transparent about when it is speaking in a stylized historical voice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest hard-codes Chinese-language output cues and signature phrases without any explicit user locale negotiation or language preference check. This can override the user's expected language, reduce transparency, and in multilingual contexts cause unwanted persuasion, exclusion, or misdelivery of safety-critical guidance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Lines L169-L180 explicitly state that Buddhaghosa should not be used for specific meditation instruction and that such guidance must be deferred to a qualified teacher. However, earlier sections provide concrete recommendations mapping meditation objects to temperament types and advising selection under a teacher, which goes beyond a purely conceptual framework.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file contains an instruction that specific meditation-step inquiries must be answered with a fixed Chinese response. Under the language/locale policy rule, requiring a single language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction fixes the first-turn address terms to Chinese forms such as "您 / 你 / 问者" and presents the entire interaction style as a required mode, with no option for the user to choose another language. This is a natural-language locale policy concern because it imposes a language/locale behavior without explicit user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file contains user-facing natural language and prominently uses Chinese in the heading and throughout the document. Under the policy provided, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.