ClawHub
Back to skill

Security audit

chinese-copywriting-guidelines-full-clawhub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese copywriting style guide that rewrites or reviews user-provided text and does not request sensitive access, persistence, or code execution.

Install this if you want an agent to apply the bundled Chinese copywriting conventions to text you provide. Be aware that it is opinionated by design; ask for review-only mode or avoid strict/disputed preferences when you do not want those style choices enforced.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Chaining Abuse

High
Category
Tool Misuse
Content
--- | ---
[vinta/paranoid-auto-spacing](https://github.com/vinta/paranoid-auto-spacing) | JavaScript
[huei90/pangu.node](https://github.com/huei90/pangu.node) | Node.js
[huacnlee/auto-correct](https://github.com/huacnlee/auto-correct) | Ruby
[sparanoid/space-lover](https://github.com/sparanoid/space-lover) | PHP (WordPress)
[nauxliu/auto-correct](https://github.com/NauxLiu/auto-correct) | PHP
[hotoo/pangu.vim](https://github.com/hotoo/pangu.vim) | Vim
Confidence
70% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
[nauxliu/auto-correct](https://github.com/NauxLiu/auto-correct) | PHP
[hotoo/pangu.vim](https://github.com/hotoo/pangu.vim) | Vim
[sparanoid/grunt-auto-spacing](https://github.com/sparanoid/grunt-auto-spacing) | Node.js (Grunt)
[hjiang/scripts/add-space-between-latin-and-cjk](https://github.com/hjiang/scripts/blob/master/add-space-between-latin-and-cjk) | Python

## Examples of “Who is doing this?”
Confidence
70% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The description and overview state that the skill applies Chinese Copywriting Guidelines to user content, which effectively forces a specific language/locale standard. There is no opt-in or alternative language/locale choice described for users who may want different style conventions.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The README is framed as normative guidance for writing and formatting specifically for Chinese, starting with 'Chinese Copywriting Guidelines' and describing rules for 'better written communication.' This imposes a specific language/locale convention without any user opt-in or explicit statement that the guidance is optional or region-specific, which matches the language/locale policy concern.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The README presents itself as a prescriptive guide for standardizing Chinese copywriting and layout, beginning with a Chinese-only title and a goal of unifying usage across a team. Because the instructions are framed normatively rather than as an optional locale-specific mode, they can be interpreted as forcing a specific language/locale standard without explicit user opt-in.

Whitespace Padding

Medium
Category
Prompt Injection
Content
## 工具

| 仓库                                                                                                                            | 语言            |
|---------------------------------------------------------------------------------------------------------------------------------|-----------------|
| [vinta/paranoid-auto-spacing](https://github.com/vinta/paranoid-auto-spacing)                                                   | JavaScript      |
| [huei90/pangu.node](https://github.com/huei90/pangu.node)                                                                       | Node.js         |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Low
Confidence
77% confidence
Finding
This markdown file references the "chinese-copywriting-guidelines" project directly in the visible changelog links, which signals a language-specific scope. Because the file provides no indication that language or locale is user-selectable or explicitly justified here, it can be read as enforcing a specific language context without opt-in.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The description explicitly frames the skill/package as "Chinese Copywriting Guidelines," which imposes a language-specific policy in natural language. There is no accompanying indication that this is optional, user-selected, or justified as a region-specific tool, so it may violate the language/locale choice requirement.

Unpinned Dependencies

Low
Category
Supply Chain
Content
],
  "readmeFilename": "README.md",
  "devDependencies": {
    "grunt": "^1.0.1",
    "grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",
Confidence
89% confidence
Finding
The devDependency 'grunt' is specified with a caret range (^1.0.1), allowing installation of newer matching versions without an exact pin. This increases supply-chain uncertainty and makes builds less reproducible; in this case it is more notable because Grunt has known advisories and the unpinned range makes it unclear what version would actually be installed.

Unverifiable Dependency: grunt has 3 known advisory(ies) (CVE-2022-0436 (Path Traversal in Grunt); CVE-2020-7729 (Arbitrary Code Execution in grunt); CVE-2022-1537 (Race Condition in Grunt)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding
The manifest includes 'grunt' without an exact version pin, and Grunt has known advisories affecting some releases. Because the installed version is not deterministically constrained here, consumers cannot verify whether vulnerable versions might be resolved, creating a low-severity but real supply-chain and tooling risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"readmeFilename": "README.md",
  "devDependencies": {
    "grunt": "^1.0.1",
    "grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",
    "matchdep": "^1.0.1"
Confidence
85% confidence
Finding
The devDependency 'grunt-bump' uses a caret version (^0.8.0), so dependency resolution may pull different package contents over time. While this is limited to development tooling, it still creates supply-chain risk and non-reproducible builds if the package or one of its transitive dependencies is compromised.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"devDependencies": {
    "grunt": "^1.0.1",
    "grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",
    "matchdep": "^1.0.1"
  },
Confidence
85% confidence
Finding
The devDependency 'grunt-conventional-changelog' is not pinned exactly, which allows version drift and weakens build integrity. Even though this appears to be release tooling, compromised or unexpected package updates can still affect developer environments or CI pipelines.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",
    "matchdep": "^1.0.1"
  },
  "contributors": [
    "Zhuang Ma <chumpma@gmail.com>",
Confidence
85% confidence
Finding
The devDependency 'matchdep' is specified with a caret range (^1.0.1), which permits non-deterministic dependency selection. That creates a low-severity supply-chain exposure because development or CI systems may install different code over time.

Static analysis

No suspicious patterns detected.