ClawHub
Back to skill

Security audit

changelog-draft-gen

Security checks for vulnerabilities and agentic risk

Overview

This looks like a normal changelog generator, but its install instructions and metadata understate important trust and execution details.

Review this skill before installing. The runtime code appears limited to reading Git history and optionally writing a changelog file, but avoid the README curl install path unless it is pinned and verified; prefer installing the reviewed package artifact and treat the permission metadata as inaccurate until corrected.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

Install & Try / 安装即试

bash
mkdir -p ~/.claude/skills/changelog-draft-gen/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/changelog-draft-gen/scripts/changelog_gen.py -o ~/.claude/skills/changelog-draft-gen/scripts/changelog_gen.py
python ~/.claude/skills/changelog-draft-gen/scripts/changelog_gen.py --help

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The installation instructions persistently place executable code into a user-level agent skills directory and fetch it directly from a remote URL with no version pinning or integrity verification. This creates a durable supply-chain foothold: if the remote content changes or is compromised, future agent sessions may continue loading attacker-controlled code from a trusted local path.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

Install & Try / 安装即试

bash
mkdir -p ~/.claude/skills/changelog-draft-gen/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/changelog-draft-gen/scripts/changelog_gen.py -o ~/.claude/skills/changelog-draft-gen/scripts/changelog_gen.py
python ~/.claude/skills/changelog-draft-gen/scripts/changelog_gen.py --help

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The line states that the block is copied intact and must be rechecked before publishing/reposting, and the referenced block is predominantly Chinese. This creates a natural-language policy concern because it imposes a specific language/locale convention rather than offering user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The top-level description is written in Chinese and does not indicate that language selection is optional. Because the policy forbids forcing a specific language or locale without user opt-in, this is a natural-language policy issue even though English text appears later in the document.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

At L113, the documentation says the tool '默认生成 Markdown 文件至当前目录' (generates a Markdown file to the current directory by default). This contradicts the structured interface and input/output contract above, which describe stdout output and an optional out parameter for writing a file (L53-L56, L61-L65), indicating file output is not the default behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language content in this file is entirely in Chinese, including the core description and guidance to AI agents. The file does not indicate that Chinese is optional, selectable by the user, or required for a region-specific purpose, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/changelog_gen.py (reported line 19)May include surrounding context.

python
def git(repo, args):
    return subprocess.run(["git", "-C", repo] + args, capture_output=True, text=True, encoding="utf-8", errors="replace")


def main():

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script's CLI description, help text, error messages, and generated changelog headings include Chinese text and bilingual labels, which imposes a specific language/locale on users. The file does not provide any option to select output language or state that the tool is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/changelog_gen.py (reported line 31)May include surrounding context.

python
ap.add_argument("--out", help="写入文件（临时文件+原子替换，校验失败不覆盖）")
    ap.add_argument("--json", action="store_true")
    a = ap.parse_args()
    if not os.path.isdir(os.path.join(a.repo, ".git")) and "git" not in subprocess.run(
            ["git", "-C", a.repo, "rev-parse", "--git-dir"], capture_output=True, text=True).stdout:
        print(json.dumps({"errors": [{"code": "CHG_E_NO_GIT", "subject": a.repo,
                                      "evidence": "不是 git 仓库", "fixes": ["在仓库根目录运行或用 --repo 指定"]}]},

Static analysis

No suspicious patterns detected.