ClawHub
Back to skill

Security audit

chinese-copywriting-guidelines-full-clawhub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese copywriting style guide that rewrites or reviews user-provided text and does not request sensitive access, persistence, or code execution.

Install this if you want an agent to apply the bundled Chinese copywriting conventions to text you provide. Be aware that it is opinionated by design; ask for review-only mode or avoid strict/disputed preferences when you do not want those style choices enforced.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Chaining Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/upstream-text/README.en.md (reported line 229)May include surrounding context.

md
--- | ---
[vinta/paranoid-auto-spacing](https://github.com/vinta/paranoid-auto-spacing) | JavaScript
[huei90/pangu.node](https://github.com/huei90/pangu.node) | Node.js
[huacnlee/auto-correct](https://github.com/huacnlee/auto-correct) | Ruby
[sparanoid/space-lover](https://github.com/sparanoid/space-lover) | PHP (WordPress)
[nauxliu/auto-correct](https://github.com/NauxLiu/auto-correct) | PHP
[hotoo/pangu.vim](https://github.com/hotoo/pangu.vim) | Vim

Chaining Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/upstream-text/README.en.md (reported line 234)May include surrounding context.

md
[nauxliu/auto-correct](https://github.com/NauxLiu/auto-correct) | PHP
[hotoo/pangu.vim](https://github.com/hotoo/pangu.vim) | Vim
[sparanoid/grunt-auto-spacing](https://github.com/sparanoid/grunt-auto-spacing) | Node.js (Grunt)
[hjiang/scripts/add-space-between-latin-and-cjk](https://github.com/hjiang/scripts/blob/master/add-space-between-latin-and-cjk) | Python

## Examples of “Who is doing this?”

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description and overview state that the skill applies Chinese Copywriting Guidelines to user content, which effectively forces a specific language/locale standard. There is no opt-in or alternative language/locale choice described for users who may want different style conventions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README is framed as normative guidance for writing and formatting specifically for Chinese, starting with 'Chinese Copywriting Guidelines' and describing rules for 'better written communication.' This imposes a specific language/locale convention without any user opt-in or explicit statement that the guidance is optional or region-specific, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README presents itself as a prescriptive guide for standardizing Chinese copywriting and layout, beginning with a Chinese-only title and a goal of unifying usage across a team. Because the instructions are framed normatively rather than as an optional locale-specific mode, they can be interpreted as forcing a specific language/locale standard without explicit user opt-in.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/upstream-text/README.md (reported line 264)May include surrounding context.

md
## 工具

| 仓库                                                                                                                            | 语言            |
|---------------------------------------------------------------------------------------------------------------------------------|-----------------|
| [vinta/paranoid-auto-spacing](https://github.com/vinta/paranoid-auto-spacing)                                                   | JavaScript      |
| [huei90/pangu.node](https://github.com/huei90/pangu.node)                                                                       | Node.js         |

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This markdown file references the "chinese-copywriting-guidelines" project directly in the visible changelog links, which signals a language-specific scope. Because the file provides no indication that language or locale is user-selectable or explicitly justified here, it can be read as enforcing a specific language context without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description explicitly frames the skill/package as "Chinese Copywriting Guidelines," which imposes a language-specific policy in natural language. There is no accompanying indication that this is optional, user-selected, or justified as a region-specific tool, so it may violate the language/locale choice requirement.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The devDependency 'grunt' is specified with a caret range (^1.0.1), allowing installation of newer matching versions without an exact pin. This increases supply-chain uncertainty and makes builds less reproducible; in this case it is more notable because Grunt has known advisories and the unpinned range makes it unclear what version would actually be installed.

Content

Scanner excerpt · references/upstream-text/package.json.txt (reported line 26)May include surrounding context.

text
],
  "readmeFilename": "README.md",
  "devDependencies": {
    "grunt": "^1.0.1",
    "grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",

Unverifiable Dependency: grunt has 3 known advisory(ies) (CVE-2022-0436 (Path Traversal in Grunt); CVE-2020-7729 (Arbitrary Code Execution in grunt); CVE-2022-1537 (Race Condition in Grunt)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The manifest includes 'grunt' without an exact version pin, and Grunt has known advisories affecting some releases. Because the installed version is not deterministically constrained here, consumers cannot verify whether vulnerable versions might be resolved, creating a low-severity but real supply-chain and tooling risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
85% confidence
Finding

The devDependency 'grunt-bump' uses a caret version (^0.8.0), so dependency resolution may pull different package contents over time. While this is limited to development tooling, it still creates supply-chain risk and non-reproducible builds if the package or one of its transitive dependencies is compromised.

Content

Scanner excerpt · references/upstream-text/package.json.txt (reported line 27)May include surrounding context.

text
"readmeFilename": "README.md",
  "devDependencies": {
    "grunt": "^1.0.1",
    "grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",
    "matchdep": "^1.0.1"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
85% confidence
Finding

The devDependency 'grunt-conventional-changelog' is not pinned exactly, which allows version drift and weakens build integrity. Even though this appears to be release tooling, compromised or unexpected package updates can still affect developer environments or CI pipelines.

Content

Scanner excerpt · references/upstream-text/package.json.txt (reported line 28)May include surrounding context.

text
"devDependencies": {
    "grunt": "^1.0.1",
    "grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",
    "matchdep": "^1.0.1"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
85% confidence
Finding

The devDependency 'matchdep' is specified with a caret range (^1.0.1), which permits non-deterministic dependency selection. That creates a low-severity supply-chain exposure because development or CI systems may install different code over time.

Content

Scanner excerpt · references/upstream-text/package.json.txt (reported line 30)May include surrounding context.

text
"grunt-bump": "^0.8.0",
    "grunt-conventional-changelog": "^6.1.0",
    "grunt-npm": "0.0.2",
    "matchdep": "^1.0.1"
  },
  "contributors": [
    "Zhuang Ma <chumpma@gmail.com>",

Static analysis

No suspicious patterns detected.