ClawHub
Back to skill

Security audit

Fact Check Guard（事实核查护栏）

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can wrongly approve false claims and does not enforce its promised file-access limits.

Treat this as a keyword-matching aid, not a reliable publication safeguard. Independently verify sources and require explicit publication approval; neither a supported label nor exit code zero establishes accuracy. Use trusted inputs and filesystem containment because selected file contents can appear unredacted in output. The partial scanner report's material gaps were investigated across all bundled files; linked ecosystem projects were not assessed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented fact-checking and publication safeguards substantially exceed the implementation: lexical overlap is labeled as support, contradictions are not detected, and unsupported results do not trigger a failing exit status or an enforced publication gate. This is particularly dangerous for a skill explicitly intended to approve factual content before publication, because downstream users or agents may treat its output as verified evidence. The declared project-only file boundary is also not enforced by the loader itself.

Content

No source excerpt is available for this finding.

Keyword overlap is presented as factual support, even when a source contradicts the claim.

High
Category
Excessive Agency
Confidence
100% confidence
Finding

The support function marks a claim as supported when any source contains enough extracted words, without checking negation, numerical accuracy, or semantic entailment. A contradictory source such as 'This treatment does not cure cancer' can therefore support the claim 'This treatment cures cancer.' Because the skill is positioned as a prepublication fact-checking safeguard, this creates a direct route for false claims to receive misleading approval.

Content

No source excerpt is available for this finding.

Input-file loading is not restricted to the declared project directory.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The loader accepts any existing readable path, including absolute paths, parent-directory traversal, and symlinks, without enforcing the declared project-directory boundary. If an untrusted argument selects a sensitive file as the claims input, its nonempty lines are reproduced in the output, potentially exposing data in logs or the agent conversation. Exploitation depends on the process having access to those files; this code does not itself transmit them over the network.

Content

No source excerpt is available for this finding.