ClawHub
Back to skill

Security audit

AI News Digest by YQG

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AI news digest skill with disclosed web-search, optional document, and optional file-output behavior, with no evidence of hidden execution, persistence, credential theft, or destructive intent.

Installers should expect this skill to use web search/fetch and, only when requested, create Feishu documents or save report output to a local path. Prefer chat output or a dedicated export folder, and confirm before overwriting existing files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes the skill as 'Zero dependencies — pure prompt-driven,' and the documentation reinforces this with 'No scripts, no APIs, no setup.' However, the workflow requires web_search and web_fetch, and delivery can use a feishu_doc tool, which are external tool dependencies rather than purely prompt-only behavior. This is a semantic mismatch between the advertised operating model and the actual implementation instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases include short, generic requests such as "AI 新闻", "科技日报", and "AI 行业趋势", which are broad enough to match ordinary conversation about AI news rather than a clearly scoped skill invocation. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Allowing output to be saved to an arbitrary user-specified file path can enable unintended writes to sensitive or important local locations, especially if the runtime grants filesystem access. In a prompt-driven news skill, this capability is broader than necessary and could be abused for overwriting files, planting content in trusted locations, or modifying local state beyond the skill's stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Saving to a user-specified path without overwrite safeguards or warnings can lead to silent modification or destruction of existing local files. This becomes more dangerous because the skill is otherwise presented as a harmless prompt-driven digest tool, so users may not expect local filesystem side effects from invoking it.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill says 'STRICT — NO EXCEPTIONS' and instructs that by default only today's news may be included, explicitly forbidding yesterday's or last week's items. Later, the checklist only verifies 'No content older than 7 days,' which permits content the earlier rules prohibit. This is an internal intent/documentation contradiction that can cause behavior drift.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.