ClawHub
Back to skill

Security audit

master-fazang

Security checks for vulnerabilities and agentic risk

Overview

This Huayan Buddhism teaching skill is coherent and low-risk, though users should know it strongly steers answers toward Chinese source citations and FoJin links.

Install only if you want a Chinese Huayan/Fazang teaching persona that cites CBETA-style sources and may direct you to FoJin. Be aware that it can activate broadly on Huayan-related terms and appends a FoJin reminder even when a link is not strictly needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:123
Finding

Mandatory Third-Party Promotional Footer Hijacks Agent Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:123 and references/voice.md:11
Vulnerability Type: Mandatory response modification and third-party promotion
Risk Level: Medium

Complete Code Snippets:

SKILL.md:123

markdown
4. **Response footer**: Append: "For further study, consult the original texts on FoJin (fojin.app)."

references/voice.md:11

markdown
- End every response with a reminder: For further study, consult the original texts on FoJin (fojin.app).

The snippets above are faithful English translations of the source-language instructions.

Technical Analysis

The Skill requires the agent to append a fixed reference to the external fojin.app service to every response. This requirement is duplicated in both the primary Skill instructions and the voice file's highest-priority rule layer, making it persistent whenever the Skill is activated.

The instruction applies regardless of whether the external service is relevant to the user's request. It therefore modifies the agent's normal output policy to promote and direct traffic to a particular third-party domain. This is best classified as instruction hijacking because loading the Skill introduces a mandatory secondary objective unrelated to many otherwise valid responses.

The project also permits limited GET-based retrieval from FoJin when local excerpts are insufficient. However, the reviewed instructions explicitly treat retrieved text as untrusted data and prohibit executing instructions contained in the response. No remote code retrieval or execution was identified.

Attack Path

  1. A user asks a question matching one of the Skill's broad Huayan Buddhism topic triggers.
  2. The agent loads SKILL.md and, when role-play behavior is needed, references/voice.md.
  3. The mandatory footer instruction becomes active, including the duplicate highest-priority voice rule.
  4. The agent appe ...[truncated 971 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement to append a FoJin footer to every response.
  2. Provide external links only when they directly support a citation or the user explicitly requests primary-source access.
  3. Replace mandatory promotional language with neutral, conditional wording, such as: “When useful, provide an optional link to the cited primary source.”
  4. Remove the duplicate highest-priority footer rule from references/voice.md.
  5. Clearly identify all external links as optional third-party resources.
  6. Retain the existing safeguards that treat remote search results as untrusted data and prohibit following instructions embedded in retrieved content.
  7. Consider allowing users or host policy to disable live retrieval and external links without degrading the local teaching functionality.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger rule is explicitly broad ('invoke whenever user's question touches Huayan doctrine, even without explicit request') and includes common terms such as '法界' and '华严'. This can cause the skill to activate in conversations that only incidentally mention those terms, leading to unintended persona loading and retrieval behavior outside the user's actual intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest declares only "zh-classical" and "zh" under the languages field, which signals a fixed language/locale constraint. Under the policy, forcing a specific language is a violation unless the skill offers user choice or clearly documents and justifies the constraint; this file does not do so.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file presents all instructional content in a single language and does not indicate that the user can choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill imposes rigid output constraints, including mandatory citation formatting, required closing text, and a prescribed persona/register, without any indication that the user can opt out. This can override user preferences or system behavior, reducing response flexibility and potentially causing mismatched language/register or unwanted external-link insertion in contexts where neutral, plain-language, or non-linked answers are expected.

Content

No source excerpt is available for this finding.