ClawHub
Back to skill

Security audit

redbook-cards-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Chinese Xiaohongshu-style card generator with limited, disclosed behavior, though users should review generated HTML before opening or publishing it.

Reasonable to install for Chinese Xiaohongshu-style HTML card generation. Use a user-chosen output filename, review generated HTML before opening or publishing it, avoid feeding sensitive private articles unless needed, and remember that previews may contact Google Fonts unless you replace the font link with local fonts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
PROMPT.md:22
Finding

Untrusted Article Content Is Interpolated Directly into Agent Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file is entirely written as a Chinese-only example and specifies Chinese fonts such as Noto Serif SC and Noto Sans SC, indicating a fixed language/locale expectation. There is no statement that the user can choose another language or that the skill is intentionally limited to a Chinese-language regional use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is explicitly framed in Chinese and directs generation of 小红书-style content, but nowhere offers a language/locale option or explains that the skill is intentionally limited to a Chinese-language publishing context. Under SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

L003 中的触发词包含“切片”等泛化词汇，且整体只给出若干关键词，没有说明必须在何种上下文中才应激活该技能。这样的描述容易与普通内容编辑、设计或笔记场景中的日常表达重叠，增加非预期调用风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

L003 只声明“自动切片生成”及一组触发词，但没有说明是基于用户显式请求生成 HTML 文件时触发，还是只要提到相关词汇就触发。缺少负面示例、约束条件或明确的调用边界，属于模糊激活描述。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

L087-L091 明确要求引入中文字体并以中文渲染质量为前提，整体技能也固定为“小红书风格”中文输出，但未说明是否允许用户选择其他语言或本地化方案。若组织要求不得在无用户选择的情况下强制特定语言/locale，这构成自然语言层面的 locale 限制问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document explicitly sets lang="zh", and all visible content is presented only in Chinese. Under the policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 16)May include surrounding context.

text
copies or substantial portions of the Skill.

THE SKILL IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file describes a workflow that ends with a File Output step saving a .html file, but it does not include any warning about where the file is written, whether existing files may be overwritten, or that local file creation will occur. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a self-contained conversion skill that slices content into Xiaohongshu-style cards and outputs a single HTML file for preview. This file includes a remote stylesheet from fonts.googleapis.com, so rendering relies on network access rather than being a fully local standalone output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.