ClawHub
Back to skill

Security audit

Huoshan Qifu Doc Knowledge Router

Security checks for vulnerabilities and agentic risk

Overview

This skill reads a specific Feishu knowledge index and linked documents using the current user's Feishu access, with no bundled code or write actions, though its trigger wording is somewhat broad.

Install only if you want the agent to use your Feishu access to search the default Huoshan/Qifu knowledge index and linked documents. Review the broad trigger wording if you prefer this to run only when explicitly named, and confirm the default Wiki URL is appropriate for your workspace.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
`https://bytedance.larkoffice.com/wiki/UOzdwymi8ibRgBko04bcX1yRnNh`

The Skill stores only this root URL. The INDEX document stores category routing metadata and links to category directory documents; category documents store knowledge entries and original detail links. If the user explicitly supplies another INDEX URL, use it only for that request. Never embed or expose access tokens, app secrets, cookies, or credentials.

Expected INDEX category fields are:

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
1. Document heading or title: exact topic match, strong synonym, or task match.
2. `关键词` and `知识标签`: explicit subject, product, process, audience, or document-type match.
3. `内容说明`: clear statement that the document serves the requested task.
4. `适用场景`: match to learning, onboarding, platform usage, SOP, or another requested scenario.
5. `族谱路径` and selected category: matching business domain and hierarchy.
6. `面向岗位`, `面向角色`, or `面向人群`, only when explicitly maintained.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The invocation description uses broad trigger phrases such as generic knowledge retrieval, document recommendation, and source-grounded answers, which can cause the skill to activate for common enterprise queries beyond a narrowly scoped use case. This increases the chance of unintended access to internal document indexes and overbroad data retrieval under the current user's identity.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## Default INDEX

Use this Wiki INDEX document without asking the user for a URL:

`https://bytedance.larkoffice.com/wiki/UOzdwymi8ibRgBko04bcX1yRnNh`

Static analysis

No suspicious patterns detected.