Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-verdict.mjs <verdict.json> # 或 report.md，或 - 从 stdin 读
Security audit
insight-challenge
Security checks for vulnerabilities and agentic risk
Overview
ClawScan marks this skill suspicious with medium confidence because it found a potentially misleading verdict validator and could not fully inspect that script.
Consider the suspicious verdict and incomplete scan coverage before installing. In particular, the validator script was only partially inspected, so the scan cannot establish its full behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
The validator claims to be fail-closed (L003), but silently discards malformed JSON blocks and can report success for a partially invalid verdict report.
Medium
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
The Markdown extractor silently skips malformed JSON and valid JSON objects that lack its verdict-identifying fields. A report containing at least one valid verdict can therefore receive a PASSED result while other intended verdicts are excluded from validation, undermining the claimed fail-closed behavior. In a finding-review skill, this can conceal incomplete or invalid review results if downstream consumers interpret success as validation of the entire report.
- Content