T01 · Skill Instruction Hijacking
Error
- Location
docs/auto-send-guide.md:45- Finding
Generated Reports May Be Sent to a Hard-Coded OpenIM Group
- Content
View full analysis
- Remediation
View remediation
Security audit
Designer Intelligence Station
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a public news/intelligence collector, but it also documents sending reports to a fixed external group and optional browser-session cookie use that are not adequately scoped or disclosed.
Review before installing. Keep it in manual mode first, inspect the source URLs, do not enable browser-cookie social integrations unless you understand the account risk, replace the hard-coded message recipient with your own confirmed destination, and avoid unattended cron runs until dependencies are pinned and URL boundaries are enforced.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
docs/social-media-setup.md:31- Finding
Optional Social-Media Setup Requests Browser Cookies and Authenticated Session Tokens
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
tools/check_dependencies.py:101- Finding
Headless Execution Automatically Installs Unpinned Python Dependencies
- Content
View full analysis
=6.0.0 requests>=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 python-dateutil>=2.8.2 ``` ### Technical Analysis The dependency checker treats an `EOFError` as affirmative consent. Scheduled jobs, detached processes, CI systems, and other non-interactive environments commonly have no usable stdin, so ordinary headless execution can trigger package installation without user approval. The requirements use lower-bound constraints rather than exact versions or hashes. Consequently, the installation may retrieve package releases and transitive dependencies that did not exist when the Skill was reviewed. Python package installation can execute package build backends or installation-related code with the permissions of the invoking user. The packages named in the file are well-known ...[truncated 1205 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/sources_manager.py:342- Finding
Unvalidated Source URLs Permit Requests to Internal or Local Services
- Content
View full analysis
") add_source( id=sys.argv[2], name=sys.argv[3], url=sys.argv[4], type=sys.argv[5] if len(sys.argv) > 5 else "Chinese media", domain=sys.argv[6] if len(sys.argv) > 6 else "AI", ) ``` The RSS fetcher opens the configured URL without validating its destination: ```python import urllib.request opener = urllib.request.build_opener() response = opener.open(url, timeout=timeout) ``` The standalone web fetcher similarly performs the request directly: ```python print(f" Fetching: {url}") response = self.session.get(url, headers=headers, timeout=self.timeout) ``` ### Technical Analysis The Skill allows sources to be added or imported and subsequently fetches their URLs without enforcing an HTTPS-only policy, approved-host allowlist, or rejection of loopback, private, link-local, and reserved IP ranges. The request libraries may also follow redirects. Validating only the initial textual hostname would therefore be insufficient: an attacker-controlled public URL could redirect to an internal address, and DNS rebinding could cause a previously public hostname to resolve to a private address at request time. Fetched responses are cached and later processed by the agent. This turns the Skill into a request primitive that can access resources reachable from the host running it rather than only public news websites. ### Attack Path 1. An attacker or untrusted source file adds a URL such as a loopback address, private-network service, or cloud metadata endpoint ...[truncated 1113 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (214)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # 重新初始化 rm data/intelligence_sources.db python3 data/import_sources.py
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill's declared purpose omits dependency inspection, environment validation, and especially automatic package installation via pip. Undisclosed package installation materially increases attack surface because execution can modify the environment and pull code from package registries, which is a significant capability beyond passive intelligence collection.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The troubleshooting guidance includes a destructive shell command that deletes the SQLite database file. In an agent or copy-paste execution context, destructive commands in documentation are dangerous because they can cause irreversible local data loss and may be executed automatically or without sufficient user understanding.
- Content
数据库错误
bash rm data/intelligence_sources.db python3 data/import_sources.py
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The README includes a directly executable destructive shell command,
rm data/intelligence_sources.db, as a troubleshooting step. Even though it is not dynamically injected input, this is still dangerous operational guidance: users may copy-paste it and irreversibly delete the primary local database, causing denial of service and potential permanent data loss if backups are missing or stale.- Content
ls -la data/intelligence_sources.db
删除重建
rm data/intelligence_sources.db python data/import_sources.py
text
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file consistently presents the skill interface, prompts, examples, and usage guidance only in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or documented justification is a reportable issue.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 配置 cron（每日早上 8 点） crontab -e # 添加以下行 0 8 * * * cd ~/.clawhub/skills/designer-intelligence-station && ./execute_daily.sh
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 监控出站连接（Linux） sudo netstat -tnp | grep python # 或使用更详细的工具 sudo tcpdump -i any -n port 80 or port 443
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 监控出站连接（Linux） sudo netstat -tnp | grep python # 或使用更详细的工具 sudo tcpdump -i any -n port 80 or port 443
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents shell execution, local file reads/writes, and live network fetching, but does not declare an explicit tool scope such as permissions or allowed-tools. That makes the operational boundary ambiguous and can lead an agent runtime to grant broader capabilities than users expect, especially given the auto-install and scheduled execution features.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest declares only
zhunderlanguages, and the rest of the skill instructions are presented exclusively in Chinese. This appears to impose a language/locale constraint without an explicit user opt-in or a documented region-specific justification, which matches the policy-violation criteria for language restrictions.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The skill instructs users to install a cron job for unattended recurring execution. Persistent scheduled execution increases risk because any future compromise, dependency issue, or source-side malicious content can be repeatedly fetched and processed without fresh user review.
- Content
bash # 配置每日早上 8 点运行 crontab -e # 添加：0 8 * * * cd ~/.clawhub/skills/designer-intelligence-station && ./execute_daily.sh
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The troubleshooting guidance instructs users to delete the SQLite database and recreate it, but it does not prominently warn that any locally added sources, runtime state, or unsaved changes may be lost unless a valid backup exists. In a skill centered on local data storage, destructive recovery steps are more dangerous because operators may run them during incidents when they are less likely to verify backup integrity first.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The summary states this is a Chinese-enhanced trading framework, explicitly constraining the skill description to Chinese without any accompanying opt-in or justification in this file. Under the stated policy, forcing a specific language is a natural-language policy concern unless the locale choice or rationale is clearly documented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This JSON manifest-like file contains natural-language descriptions, so SQP-3 applies. The summary at L062 advertises real-time human pose estimation, vital sign monitoring, and presence detection, which is a sensitive surveillance-oriented capability presented without any user opt-in, consent framing, or contextual limitation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a JSON manifest-like file, so vague-trigger checks apply. The phrase "researches any topic" is overly broad and does not define activation boundaries, exclusions, or contextual limits, which could contribute to unintended invocation in a skill-discovery or routing context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON file is a manifest-like data file, so SQP-3 applies to its natural-language fields. The summary explicitly advertises human pose estimation, vital sign monitoring, and presence detection, which are privacy-sensitive monitoring capabilities, but the text provides no indication of user choice, consent, or a justified locale/compliance context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a designer-intelligence collector focused on 46 public sources in AI, hardware, mobile, and design. This cached RSS data includes general consumer shopping/deals content about robot vacuums, which does not fit those stated categories and suggests the implemented collection scope is broader than advertised.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest claims a designer intelligence collection tool with topic coverage limited to AI, hardware, mobile, and design. This entry tracks Netflix subscription pricing, which is general entertainment business news and not an obvious implementation detail of the declared purpose.
- Content
Static analysis
No suspicious patterns detected.