ClawHub
Back to skill

Security audit

PRD to Prototype

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it can automatically create files and deploy prototypes from broad product-related prompts without enough user control.

Review before installing if you want tight control over when skills run. This skill should be used only when you explicitly want a PRD/prototype workflow, and you should confirm output paths and deployment behavior before letting it run on sensitive business ideas or internal product flows.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: 8e25991f61069ffc6cc28e33d38ed17d
    PropagateID: 8e25991f61069ffc6cc28e33d38ed17d
    ReservedCode1: 3045022100919684f66b4830d8aa8c13fe3fe5eb1df44b8f82535e81a8214fe833c13fb3030220513585ce8a8da7911923f5ae98a203077163299bbb12b98e5c7056c1d5bfb2c1
    ReservedCode2: 304402201fe77b09dacbda84d317c5ebe24ab6bf489a9b72ac8983032a81bd4109d167b702205907c1cb18f5336b47848f966b850e6aab4a1c233cec8979f9f3d95361aa8cf6
description: 从产品需求到可交互原型的完整工作流。当用户表达产品想法（如'我想做一个...'、'帮我设计...'）时触发。支持：1) 零提问直出PRD 2) 平台选择确认 3) 生成Awwwards级别的高保真HTML/Tailwind原型（移动端/PC端）。端到端�

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description is broad enough to trigger on ordinary product-related conversation, which can cause the agent to take over benign chats unexpectedly. In this skill, accidental activation is more dangerous because it immediately performs a no-questions-asked workflow that writes files and can lead to later deployment.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation condition says any product idea, need, pain point, or creative input should trigger the skill, which is excessively ambiguous. Given the enforced 'zero delay' execution model, this can hijack normal conversation and start filesystem-modifying actions without clear user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill includes deployment behavior and promises a preview link without requiring an explicit user consent step for publication or exposure. That creates a real risk of unintentionally making generated content accessible externally, which is especially problematic if the PRD or prototype contains sensitive business ideas, internal flows, or embedded data.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
<meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>产品名称</title>
    <!-- 引入 Tailwind -->
    <script src="https://cdn.tailwindcss.com"></script>
    <!-- 引入 FontAwesome -->
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to write /workspace/docs/prd.md without first warning the user that files will be created or modified. This is unsafe because unexpected local state changes can overwrite existing work, create confusion about provenance, and normalize unauthorized filesystem actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file requires all interface copy, data, and buttons to be in Simplified Chinese unless the user specifies another language. This sets a default language policy on the user without prior choice or opt-in, which matches the language-policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.