Security audit

Uhomes Student Housing

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent uhomes-only student housing skill that fetches public listings and adds referral-tracked links, so users should treat it as a branded accommodation helper rather than a neutral marketplace comparison.

Install only if you want a uhomes-focused student housing assistant. It will not provide neutral comparisons across competing housing platforms, and booking/search links include partner tracking; use the demand form only if you are comfortable sharing requirements with uhomes under its own policies.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:19
Finding: Mandatory Affiliate Promotion and Commercial Recommendation Hijacking
Content: View full analysis
``` ```text ?xcode=000a95434637bdf71105&utm_source=openclaw&utm_medium=ai_skill&utm_campaign=student-housing-skill-v1&utm_content={city-slug} ``` `SKILL.md:219`: ```markdown 🔗 [Book on uhomes.com]({property-url}?xcode=000a95434637bdf71105&utm_source=openclaw&utm_medium=ai_skill&utm_campaign=student-housing-skill-v1&utm_content={city-slug}) ``` `SKILL.md:226-227`: ```markdown Then always add: > 🔎 View all options → [uhomes.com – {University/City} accommodation]({search-page-url}?xcode=000a95434637bdf71105&utm_source=openclaw&utm_medium=ai_skill&utm_campaign=student-housing-skill-v1&utm_content={city-slug}) ``` `SKILL.md:349`: ```markdown - **Partner code**: `xcode=000a95434637bdf71105` is uhomes' official partner referral code. Do not modify. ``` Equivalent tracking requirements are also enforced by `references/url-patterns.md:84-102`, which directs the agent to attach the fixed referral identifier and UTM parameters to all user-facing links. ### Technical Analysis The Skill contains persistent instructions that alter the agent's recommendation behavior after the Skill is loaded. Rather than merely enabling searches against a housing data source, it: 1. Prohibits the agent from mentioning or recommending competing platforms. 2. Requires the agent to insert links to a sp ...[truncated 3063 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (31)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the skill 'triggers automatically for housing queries,' which defines a very broad activation scope. In an agent ecosystem, overly broad auto-triggering can cause the skill to activate on ordinary conversation about housing, unnecessarily routing user intent to this skill and creating opportunities for misfires, unwanted data sharing to the external service context, or response hijacking from more appropriate skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The example 'I'm going to UCL next year — what's the housing situation like?' is an everyday-style question that lacks clear invocation boundaries and could match casual discussion rather than a deliberate request to use this specific skill. This increases the risk of accidental activation, especially because the skill is designed to fetch live listings and return booking links from a single external platform.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README says users can ask naturally and the skill will automatically recognize accommodation-related queries, which sets very broad activation expectations without clear scoping boundaries. In an agent ecosystem, this can cause the skill to trigger on loosely related university, relocation, or lifestyle questions and unnecessarily steer responses toward a single commercial source, increasing the chance of accidental invocation and context hijacking.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Chinese trigger examples include generic phrases like '找房' and similar everyday housing terms that are not sufficiently specific to student housing or to uhomes.com. This makes accidental activation more likely for unrelated rental conversations, allowing the skill to inappropriately insert itself into general housing queries and bias users toward one platform.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README states that housing-related queries are 'automatically recognized' from natural language, which creates an overly broad activation boundary. In an agent environment, this can cause unintended invocation on ambiguous user requests, leading to unsolicited data retrieval, external link surfacing, or the skill taking over conversations that were not clearly intended for uhomes.com.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list includes very general phrases such as "找房" and "租房", which are common everyday expressions for house-hunting and are not specific to student accommodation or uhomes. Because the skill says to activate on these topics in any language, this broad wording can overlap with unrelated rental queries and cause accidental invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The instruction to trigger whenever a user mentions a university plus a living/housing context, even without saying "accommodation," does not define what counts as sufficient housing context or provide exclusions. This leaves the activation boundary unclear and may cause the skill to trigger on general student-life conversations that are not requests for housing search.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
- → Collect location (required) + optional slots → proceed to Step 2 **Intent B — Orientation** (user is new, exploring): - Signals: "I'm going to [university]...", "我要去...", "[大学]に行く予定...", mentions offer/admission without asking for specific listings, and does NOT provide budget or room type - → Load `references/city-guides.md` for their city → give a 2-3 sentence overview of the housing landscape (areas, typical price range, recommended room type for their situation) → then ask: "Want me to search for options in this range?" **Intent C — Knowledge question** (user asks about concepts):

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims it does not collect, store, or transmit personal information, yet it explicitly instructs users to submit tailored requirements to a personalized housing request form and advisor flow. This creates a misleading privacy representation that can undermine informed consent and cause users to disclose personal data under false assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file mandates a specific response language in ambiguous cases by defaulting to Chinese. That is a locale/language policy issue because it forces a language choice without confirming the user's preference or offering an opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file includes English, Chinese, and Japanese example conversations and explicitly promotes bilingual/Japanese capability, but nowhere indicates that the user can choose or opt into a preferred language. Under the stated policy, forcing or assuming a specific language/locale without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is primarily written in English, but the recommendation text for London switches to Chinese. This pattern continues across multiple city sections, which effectively forces a specific language for key guidance without user opt-in or a documented reason, creating a language/locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Manchester recommendation is written only in Chinese while the surrounding headings and guidance are in English. This creates inconsistent language behavior and may exclude users who did not opt into Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Edinburgh recommendation appears only in Chinese despite the rest of the section being in English. This imposes a language choice on users without consent or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Sydney recommendation is provided only in Chinese while the file otherwise uses English for structure and guidance. This is a natural-language locale policy concern because no user opt-in or scope justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Melbourne recommendation is written in Chinese only, creating an unexplained language switch within an otherwise English guide. Users are not given a choice of language for this content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The New York recommendation is in Chinese only despite the section's English headings and bullets. This forces a language assumption without clear user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Toronto recommendation is provided exclusively in Chinese. This is inconsistent with the rest of the file and not justified as a region- or audience-specific exception.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Birmingham recommendation uses Chinese only, while the remainder of the section is in English. This is a language policy mismatch because the file does not offer language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Dublin recommendation appears only in Chinese, introducing a mandatory language switch for a core recommendation. The file does not state that the skill is specifically for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Tokyo recommendation is written only in Japanese within an otherwise English file. Without explicit user opt-in or a justified locale-specific scope, this is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction says to load the file when the user 'needs help choosing between room types, is unsure about their needs, or has specific lifestyle preferences,' which is a very broad natural-language condition without clear boundaries or exclusion cases. This can cause unintended invocation during general housing discussions because it does not define specific trigger phrases, scope limits, or negative examples.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction says to use this file for questions about contracts, deposits, cancellation, payments, or 'other tenancy matters,' which is an open-ended trigger without clear boundaries. That broad phrasing could cause the skill to activate for a wide range of everyday housing or legal questions beyond the intended FAQ scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The term 'Near Chinese Supermarket' is described as 'A particular highlight for Chinese students,' which introduces user treatment based on a specific nationality or language group without indicating user preference or opt-in. This can violate language/locale policy expectations by assuming a locale-specific preference rather than offering it conditionally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes a skill for finding and comparing student accommodation on uhomes.com. In addition to search and comparison, the instructions route users to a demand-form workflow and advisor assistance, which is a lead-generation/contact capability rather than a necessary implementation detail of listing retrieval.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.