ClawHub
Back to skill

Security audit

asset-controlled-export-pipeline

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate asset export and metadata tool that edits local design files and can use a local model, with the sensitive behavior mostly disclosed and aligned with its purpose.

Install only if you want an agent-assisted workflow that can download assets and rewrite local PNG/SVG files with provenance metadata. Use it on a dedicated asset library with backups, review the URL map and asset index before running scripts, and use template mode if you do not want metadata sent to a localhost model service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill metadata and description present the capability as a controlled export pipeline, but the finding indicates the underlying implementation also invokes a local HTTP model service, alters existing PNG/SVG assets, and performs metadata injection/restoration workflows that are not transparently disclosed. This is dangerous because operators may grant the skill access expecting passive export behavior, while it can actually modify local assets and interact with additional services, increasing the risk of unintended data exposure, integrity loss, and unsafe trust decisions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
| 文档与理论文本 | 本 `SKILL.md`、`README.md`、其中「理论依据」段与一切理论表述 | **不在 MIT 覆盖范围内**：保留所有权利（All rights reserved） |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
| 文档与理论文本 | 本 `SKILL.md`、`README.md`、其中「理论依据」段与一切理论表述 | **不在 MIT 覆盖范围内**：保留所有权利（All rights reserved） |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest advertises a very broad set of trigger phrases spanning asset export, copyright metadata, tracing, controlled distribution, and generic design asset management without clear scope limits or exclusion conditions. In an agent environment, overly broad activation can cause the skill to engage in contexts the user did not explicitly intend, increasing the chance of unnecessary data export, metadata injection, or provenance-processing on sensitive design assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script posts asset information, including platform, card type, visual style, and trace code, to a local HTTP endpoint. Although the module docstring mentions using a local model, the code path performing the transmission has no inline confirmation prompt or user-facing disclosure that metadata is being sent over HTTP.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code copies backup files onto the target paths and then rewrites both PNG and SVG assets in place. While the top docstring describes the behavior generally, there is no explicit per-operation warning or confirmation before these potentially destructive file overwrites occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description states that a local model can '逐张生成中文声明文案', which specifies Chinese-language generation without indicating user choice or opt-in. This creates a language/locale policy issue because the skill appears to impose a fixed language rather than offering a configurable output language.

Content

No source excerpt is available for this finding.