ClawHub
Back to skill

Security audit

ai-usage-policy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple local AI policy generator, with some documentation inconsistencies but no evidence of hidden, destructive, persistent, or data-exfiltrating behavior.

Before installing, expect a local Markdown generator whose default output is Chinese and whose README/SKILL usage examples may be stale. Use the script's --help output as the source of truth, and be cautious about granting WebFetch or broad Write access unless your agent platform requires those permissions for packaging rather than runtime.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructions are entirely in Chinese and do not offer an alternate language or explicit opt-in, which can cause an agent or operator to misunderstand operational constraints and modification boundaries. In a security-sensitive agent workflow, language-only documentation increases the chance that safeguards such as 'do not perform remote writes' or 'stop on compliance-sensitive edits' are ignored or misapplied due to comprehension gaps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language disclosure block hard-codes "China" as part of the asset's attribution statement. For a general-purpose AI usage policy generator, this imposes a locale-specific framing without offering user choice or explaining that the skill is intended only for a China-specific compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The changelog states a 'Bilingual rewrite (full EN+ZH, English first)', which is a natural-language locale preference baked into the skill documentation. Because the file does not present this as an optional user-selectable preference or justified region-specific requirement, it conflicts with the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest declares the entry point as scripts/ai_usage_policy.py with inputs team, allowed-for, forbidden, and escalation (L034, L038-L065), but the English and Chinese usage sections instruct running python ai_usage_policy.py generate with different flag names such as --target_team, --banned_areas, and --report_line (L096-L099, L120-L123). This is an active contradiction between the skill's documentation and its declared interface, which can mislead operators about how the skill actually works.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring, CLI description, help text, and generated markdown content are all written in Chinese, and there is no option to select another language or explicitly opt into this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless clearly documented as region-specific.

Content

No source excerpt is available for this finding.