ClawHub
Back to skill

Security audit

AI Content Labeling Compliance（AI内容标识实操）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AI-content-labeling compliance guide with a small local Python toolkit and no evidence of hidden network, credential, persistence, or destructive behavior.

Installers should understand this is mainly a Chinese-language compliance reference with optional local Python commands. The verification scripts can overwrite files under artifact/verify if run manually, and the legal/regulatory guidance should be checked against current official sources before relying on it for legal decisions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose is AI-content labeling compliance, but the detected behavior reportedly reads local JSON benchmark/security data and generates SVG scoring visualizations unrelated to that purpose. This mismatch is dangerous because users and agent frameworks may grant trust or permissions based on the stated compliance use case while the underlying code accesses different local artifacts and performs undeclared processing, which is a classic avenue for deceptive data access and unauthorized reporting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The statement "品牌署名统一用「注册老炮」" prescribes a fixed naming/labeling form in Chinese and says other forms must not appear. This is a natural-language policy concern because it enforces a specific language/locale presentation without offering user opt-in or documenting a region-specific justification.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises executable local tooling and shell-based usage but does not declare any explicit tool scope or permission boundaries. That creates a real trust and containment problem: an agent or reviewer cannot tell in advance what file or shell access is expected, increasing the risk of over-broad execution and unintended local file modification if the skill is invoked automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

This manifest uses Chinese-only natural-language package and author naming, and the file provides no indication that the skill is region-specific or that users can opt into a Chinese locale. Under the stated policy, forcing a specific language without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

For all file types, natural-language policy violations include forcing a specific language without user opt-in. The module docstring and command help text are presented only in Chinese, and the file does not indicate that the tool is restricted to Chinese-speaking or region-specific users, nor does it offer an alternative language or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file's natural-language framing is explicitly Chinese-only and all user-facing strings in the script are Chinese, with no indication that language is configurable or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/content_label_quality_test.py (reported line 56)May include surrounding context.

python
def check_tools():
    items = []
    try:
        r = subprocess.run([PYTHON, TOOL, "must", "--content", "用AI生成的产品宣传图片，发到公众号"],
                           capture_output=True, text=True, timeout=60)
        out = r.stdout or ""
        items.append({"name": "must 命令执行", "pass": r.returncode == 0 and "标识义务判定" in out and "图片" in out})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/content_label_quality_test.py (reported line 60)May include surrounding context.

python
capture_output=True, text=True, timeout=60)
        out = r.stdout or ""
        items.append({"name": "must 命令执行", "pass": r.returncode == 0 and "标识义务判定" in out and "图片" in out})
        r2 = subprocess.run([PYTHON, TOOL, "checklist", "--scene", "video"], capture_output=True, text=True, timeout=60)
        items.append({"name": "checklist 命令执行", "pass": r2.returncode == 0 and "视频" in (r2.stdout or "")})
        r3 = subprocess.run([PYTHON, TOOL, "metadata", "--type", "image"], capture_output=True, text=True, timeout=60)
        out3 = r3.stdout or ""

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/content_label_quality_test.py (reported line 62)May include surrounding context.

python
items.append({"name": "must 命令执行", "pass": r.returncode == 0 and "标识义务判定" in out and "图片" in out})
        r2 = subprocess.run([PYTHON, TOOL, "checklist", "--scene", "video"], capture_output=True, text=True, timeout=60)
        items.append({"name": "checklist 命令执行", "pass": r2.returncode == 0 and "视频" in (r2.stdout or "")})
        r3 = subprocess.run([PYTHON, TOOL, "metadata", "--type", "image"], capture_output=True, text=True, timeout=60)
        out3 = r3.stdout or ""
        items.append({"name": "metadata 命令执行", "pass": r3.returncode == 0 and "content_attribute" in out3 and "provider_name" in out3})
        r4 = subprocess.run([PYTHON, TOOL, "compare"], capture_output=True, text=True, timeout=60)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/content_label_quality_test.py (reported line 65)May include surrounding context.

python
r3 = subprocess.run([PYTHON, TOOL, "metadata", "--type", "image"], capture_output=True, text=True, timeout=60)
        out3 = r3.stdout or ""
        items.append({"name": "metadata 命令执行", "pass": r3.returncode == 0 and "content_attribute" in out3 and "provider_name" in out3})
        r4 = subprocess.run([PYTHON, TOOL, "compare"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""
        items.append({"name": "compare 命令执行", "pass": r4.returncode == 0 and "中国" in out4 and "欧盟" in out4})
        r5 = subprocess.run([PYTHON, TOOL, "audit"], capture_output=True, text=True, timeout=60)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/content_label_quality_test.py (reported line 68)May include surrounding context.

python
r4 = subprocess.run([PYTHON, TOOL, "compare"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""
        items.append({"name": "compare 命令执行", "pass": r4.returncode == 0 and "中国" in out4 and "欧盟" in out4})
        r5 = subprocess.run([PYTHON, TOOL, "audit"], capture_output=True, text=True, timeout=60)
        items.append({"name": "audit 命令执行", "pass": r5.returncode == 0 and "整改" in (r5.stdout or "")})
    except Exception as e:
        items = [{"name": f"执行失败: {e}", "pass": False}]

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/content_label_quality_test.py (reported line 84)May include surrounding context.

python
items = []
    for content, expects in cases:
        try:
            r = subprocess.run([PYTHON, TOOL, "must", "--content", content], capture_output=True, text=True, timeout=60)
            ok = r.returncode == 0 and any(e in (r.stdout or "") for e in expects)
            items.append({"name": f"must「{content[:12]}…」→{expects[0]}", "pass": ok})
        except Exception as e:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains user-facing natural language exclusively in Chinese, and there is no statement that the skill supports multiple languages or that Chinese is a required locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This code creates the verify directory and writes security_results.json, which is a file write operation. In this file there is no confirmation prompt, warning comment/docstring near the write, or user-facing disclosure that execution will create or overwrite local output artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This SVG contains user-visible labels entirely in Chinese for the chart dimensions, which imposes a specific language on end users. The file does not indicate that the skill is China-specific or provide any opt-in or alternative locale, so it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The main title, legend, and footer are all fixed in Chinese, which can be a natural-language locale policy issue when no user choice or region-specific justification is stated. Because this is a presentation asset, the language constraint is explicit and user-facing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This JSON contains multiple user-facing natural-language labels and notes exclusively in Chinese, such as the note on L004 and dimension labels throughout the file. Under the language/locale policy rule, forcing a specific language without opt-in or a documented justification can be a policy concern.

Content

No source excerpt is available for this finding.