ClawHub
Back to skill

Security audit

AI Observability（AI可观测性监控）

Security checks for vulnerabilities and agentic risk

Overview

This is a local, zero-dependency AI observability guide and helper toolkit with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install this if you want a Chinese-first AI observability playbook and simple local checklist tool. Review the license/copyright wording because it mixes MIT licensing with restrictive knowledge-use language, and treat the bundled security audit as publisher context rather than an independent guarantee.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A strong mismatch between the declared observability purpose and the detected behavior is a security-relevant integrity issue because users and orchestrators may grant trust or permissions based on the stated function while the implementation does something materially different. If the underlying code consumes unrelated security benchmark data and generates compliance-style visualizations instead of the described observability outputs, it can mislead operators, mask hidden behavior, and cause inappropriate tool access or unsafe deployment decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction '品牌署名统一用「注册老炮」' and '不得出现个人真名、在职公司或内部路径' imposes a fixed language/labeling requirement in natural language. Under the policy, forcing a specific language or locale presentation without user choice can be a natural-language policy violation, and this file does not offer any opt-in or alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing content solely in Chinese, which can force a specific language on users without opt-in or explanation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises execution of a local Python tool and references broader capabilities, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this creates an overbroad trust boundary where file, shell, or network actions may be available without clear least-privilege constraints, increasing the chance of unintended or abusive operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest uses Chinese-only natural-language identifiers for the package and author, but provides no indication that the skill is region-specific or that users can opt into this locale. Under the language/locale policy, a skill should not implicitly force a specific language without documented choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains natural-language docstrings, labels, and console output entirely in Chinese, including the title, dimension labels, and status messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This Python file contains natural-language descriptions entirely in Chinese, including the module docstring that frames the skill's monitoring and verification behavior. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation, and no alternative language choice or justification is provided in this file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/observability_quality_test.py (reported line 23)May include surrounding context.

python
def run_tool(args, timeout=30):
    try:
        r = subprocess.run([PY, os.path.join(TOOLS, "observability_toolkit.py")] + args,
                           capture_output=True, text=True, timeout=timeout)
        return r.returncode, r.stdout or ""
    except Exception as e:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file embeds all category labels in Chinese, and the title and legend text elsewhere in the SVG are also Chinese-only. For a general-purpose skill asset, that imposes a specific language/locale without any visible opt-in or justification, which matches the policy rule for language/locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The main title, legend labels, and footer note are presented only in Chinese, which forces a specific language presentation for users of this asset. Because the file does not indicate that it is a region-specific compliance artifact or offer any language choice, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file contains user-facing natural-language content in Chinese (for example, the note field) and the remainder of the labels/check names are also Chinese-only. For SQP-3, a skill artifact that effectively enforces a specific language without opt-in or justification is a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring and command descriptions are entirely in Chinese, and the CLI help text is also presented only in Chinese. For a general-purpose observability toolkit, this imposes a specific language/locale without user opt-in or justification, which matches the language-policy concern for natural-language content.

Content

No source excerpt is available for this finding.