ClawHub
Back to skill

Security audit

brightdata-research

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent research purpose, but it asks for broad persistent setup and document-writing powers that need careful review before installation.

Install only if you are comfortable with global npm/npx changes, BrightData usage, and Feishu/Lark document access. Prefer manually installing pinned versions, approving exact Lark scopes, using append-only document updates, previewing output before writes, and avoiding automatic git init or git add -A in personal or sensitive workspaces.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T08 · Insecure Dependencies

Error
Location
references/environment-checklist.md:10
Finding

Automatic Unpinned Global Installation of Third-Party CLI Packages

Content
View full analysis

Vulnerability Details

File Location: references/environment-checklist.md:10-18
Vulnerability Type: Unpinned global dependency installation
Risk Level: High

Affected instructions:

text
**Detection:**
- MCP method: Check whether the `mcp__brightdata__search_engine` tool is available
- CLI method: `which brightdata 2>/dev/null && brightdata --version`

**Automatically repairable:**
- BrightData CLI not installed → automatically execute `npm install -g @brightdata/cli`

**User intervention required:**
- MCP method: The user must configure the MCP server and provide an API token
- CLI method: The user must run `brightdata login` to authenticate

Equivalent unpinned global installation instructions also occur in:

  • README.md:35-36
  • README.md:42-44
  • references/brightdata-mcp-setup.md:57-59
  • references/brightdata-mcp-setup.md:145-148
  • references/environment-checklist.md:48-51
  • references/lark-cli-install-and-auth.md:12-21
  • references/lark-cli-install-and-auth.md:69-73
  • references/known-failures-and-fallbacks.md:38-41
  • references/known-failures-and-fallbacks.md:50-54

Technical Analysis

The Skill authorizes the Agent to install the latest available versions of @brightdata/cli and @larksuite/cli globally. No package version, lockfile, integrity hash, or reviewed artifact is specified.

npm installation can execute package lifecycle scripts with the privileges of the Agent's operating-system account. Because the selected package version can change after the Skill has been audited, the effective executable code is not fixed by the reviewed project. Global installation also modifies the user's persistent command environment rather than an isolated project environment.

Automatic installation is not required for the declared research workflow because the Skill already supports safe degradation when the relevant CLI is unavailable.

Attack Pa

...[truncated 1184 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not install packages automatically; obtain explicit user approval after displaying the package, source, version, and installation scope.
  2. Pin each dependency to a reviewed exact version instead of resolving the latest release.
  3. Use a lockfile and verified integrity metadata where supported.
  4. Prefer a project-local, disposable environment over npm install -g.
  5. Disable or review package lifecycle scripts during installation where operationally possible.
  6. Default to the documented degraded workflow when a dependency is absent.
  7. Periodically review pinned versions before updating them.

T03 · Remote Payload Retrieval and Execution

Error
Location
references/lark-cli-install-and-auth.md:12
Finding

Unattended Global Installation of a Mutable Remote Skill Collection

Content
View full analysis

Vulnerability Details

File Location: references/lark-cli-install-and-auth.md:12-24
Vulnerability Type: Remote Skill retrieval with excessive capability expansion
Risk Level: High

Affected instructions:

text
## Installation Steps

### 1. Install CLI

```bash
npm install -g @larksuite/cli

2. Install Skills

bash
npx skills add https://github.com/larksuite/cli -y -g

This installs 19 Feishu Agent Skills covering 11 business domains, including calendar, messaging, documents, and spreadsheets.

text

The same remote installation command is repeated in:
- `README.md:42-46`
- `references/environment-checklist.md:48-55`
- `references/lark-cli-install-and-auth.md:69-76`
- `references/known-failures-and-fallbacks.md:50-56`

### Technical Analysis

The Skill needs Feishu/Lark document reading and writing, but the prescribed command installs 19 Agent Skills globally, including capabilities for unrelated domains such as messaging and calendars. The GitHub URL is not pinned to a reviewed commit, tag, or content digest.

The `-y` option removes interactive confirmation, while `-g` extends the installation beyond the current project. Consequently, content retrieved from a mutable remote repository can become trusted Agent instructions or functionality after the present Skill has been reviewed.

This behavior exceeds minimum privilege because document-specific functionality would be sufficient for the declared workflow.

### Attack Path

1. The Agent finds that Lark document support is unavailable.
2. The Skill directs it to invoke `npx skills add` with automatic confirmation and global scope.
3. The installer retrieves the current contents of the referenced GitHub repository rather than a reviewed immutable revision.
4. All 19 Skills are installed, including Skills unrelated to document research.
5. If the repository, maintainer account, dependency chain, or resolved branch is c
...[truncated 855 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove -y and require informed user confirmation before retrieving any remote Skill.
  2. Pin the source to a reviewed immutable commit and verify its expected digest.
  3. Install only the document-specific Skills required for fetch and append operations.
  4. Avoid global installation; use a project-scoped or isolated Skill directory.
  5. Present the full list of capabilities that will be installed before requesting approval.
  6. Review the retrieved Skill contents and dependencies before enabling them.
  7. Use the existing Markdown-only fallback if scoped document support cannot be installed safely.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/lark-cli-install-and-auth.md:38
Finding

Overbroad Lark OAuth Authorization Instead of Document-Scoped Access

Content
View full analysis

Vulnerability Details

File Location: references/lark-cli-install-and-auth.md:38-50
Vulnerability Type: Excessive OAuth permissions
Risk Level: High

Affected instructions:

text
### 4. Login and authorize

```bash
lark-cli auth login --recommend

--recommend automatically selects commonly used permission scopes.

5. Verify status

bash
lark-cli auth status

Successful output should display the logged-in identity and permission list.

text

The same authorization guidance appears in:
- `README.md:42-46`
- `references/environment-checklist.md:53-56`
- `references/lark-cli-install-and-auth.md:83-88`
- `references/known-failures-and-fallbacks.md:62-69`

### Technical Analysis

The declared workflow requires reading and updating specified Feishu/Lark documents. The `--recommend` option delegates scope selection to a general-purpose CLI profile instead of explicitly requesting only the document scopes needed for the current operation.

This is especially significant because the setup also installs Skills covering messaging, calendar, spreadsheet, and other business domains. A broadly scoped user token creates a larger authorization boundary than document deduplication and append operations require.

The user must still approve the OAuth flow, so this is not a silent authentication bypass. However, describing the broad profile as the standard login path does not implement least privilege and may cause users to approve access without understanding which unrelated scopes are included.

### Attack Path

1. The user requests document research or a document update.
2. The Skill instructs the user to run `lark-cli auth login --recommend`.
3. The CLI requests its general recommended scope set instead of narrowly defined document scopes.
4. The user approves the browser or QR-code authorization flow.
5. The resulting credential is stored for later CLI operations.
6. If the CLI
...[truncated 742 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace --recommend with explicit minimum scopes for the operation being performed.
  2. Separate read-only document access from document-update authorization.
  3. Request additional scopes incrementally only when a user explicitly requests the associated feature.
  4. Display the exact requested scopes and their purpose before opening the authorization flow.
  5. Avoid requesting messaging, calendar, spreadsheet, or organization-wide scopes for document-only tasks.
  6. Document how users can inspect and revoke stored authorization.
  7. Prefer short-lived or narrowly bound credentials where the platform supports them.

T09 · Insecure Skill Coding Practices

Warning
Location
references/environment-checklist.md:71
Finding

Automatic Repository-Wide Staging and Commit for Optional Subagent Support

Content
View full analysis

Vulnerability Details

File Location: references/environment-checklist.md:71-85
Vulnerability Type: Unsafe repository mutation and sensitive-file staging
Risk Level: Medium

Affected instructions:

text
### 1. subagent / Agent capability

**Detection:**
```bash
git rev-parse --is-inside-work-tree 2>/dev/null && git rev-parse HEAD 2>/dev/null

Automatically repairable:

  • Not in a Git repository → automatically run git init
  • No commit exists → automatically run git add -A && git commit -m "init"

User intervention required: None, if automatic Git initialization is permitted.

If unavailable:

  • Switch to serial execution by the primary Agent
  • Preserve the same deduplication and aggregation discipline
text

A related consent requirement appears at `references/known-failures-and-fallbacks.md:108-115`, which says initialization should occur if the user allows it. That partially mitigates the issue, but it conflicts with the environment checklist's designation of the operation as automatically repairable.

### Technical Analysis

`git add -A` stages all tracked and untracked files under the repository scope. In an arbitrary working directory, this can include `.env` files, API keys, generated output, private documents, local configuration, or unrelated project artifacts.

A commit places staged content into Git object history, where removing it from the working tree does not remove it from the repository. If the repository later has or acquires a remote, an ordinary push can transmit the committed content.

The mutation is not necessary for the Skill's core functionality. The project explicitly states that subagents affect only efficiency and that the primary Agent can execute the workflow serially.

### Attack Path

1. The Skill attempts to use optional worktree-based subagents.
2. The current directory is not a repository, or its `HEAD` cannot be resolved.
...[truncated 906 chars]
Remediation
View remediation

Remediation Suggestions

  1. Default to primary-Agent serial execution when Git prerequisites are absent.
  2. Never initialize or commit a user's working directory solely to enable an optional optimization.
  3. Require explicit, operation-specific user consent before any repository mutation.
  4. If isolation is essential, create a dedicated clean temporary workspace rather than modifying the current directory.
  5. Create and review an appropriate .gitignore before staging files.
  6. Stage an explicit allowlist of known-safe files instead of using git add -A.
  7. Show the user git status --short and the complete staged-file list before committing.
  8. Scan staged content for secrets and confirm that no remote will receive the commit.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Permitting automatic git init, git add -A, and git commit is unrelated to batch research and can silently stage and persist arbitrary local files into version control. In a research skill operating on user workspaces, this is especially risky because it may capture secrets, proprietary documents, or unrelated artifacts and leave a durable audit trail or enable later exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The --mode replace example can overwrite an entire remote document, yet the documentation provides no explicit destructive-action warning, backup guidance, or confirmation requirement. In this skill's context—organizing and updating shared research docs—accidental use could destroy existing team content or cause broad integrity loss in collaborative documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly promotes automatic Feishu/Lark document writes as part of an end-to-end pipeline, but it does not clearly warn that the skill can modify external user data or recommend confirmation before writes. In an agent setting, this increases the chance of unintended document modification, duplicate entries, or corruption of user-maintained records if the workflow triggers too eagerly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is designed to auto-activate on a wide range of loosely phrased requests, including cases where the user does not explicitly invoke it. In a skill that performs batch web research, external scraping, and Feishu/Lark document writes, broad triggers increase the chance of unintended execution, causing data to be sent to third-party services or documents to be modified without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly supports automatic environment repair, external search/scraping, and writing/appending to Feishu documents, but the instructions do not foreground consent, external data transmission, credential use, or document-modification risks. In practice, this can lead to silent installation/auth flows, use of existing tokens, and unintended writes to user-owned documents, which is especially risky because the workflow emphasizes automatic mode selection and context reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The evals repeatedly normalize writing to Feishu as part of the default success path, but they do not require an explicit warning or confirmation before modifying external user data. In practice, this can cause the agent to append, overwrite, or otherwise alter a user's document based on inferred intent, increasing the risk of unintended data modification and privacy exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger example is overly broad for a skill that can perform batch web research and append results into Feishu. A vague request like '帮我搜几个便宜的 Claude API 代理' can activate a workflow with external search, deduplication against prior records, and potential document modification without sufficiently explicit user confirmation about scope or side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

文件标题及全文以中文编写，未说明这是面向特定中文用户群体的区域性文档，也没有提供可选语言或用户选择机制。根据语言/locale 政策，未经用户选择而强制单一语言可能构成自然语言层面的策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The entire checklist is written in Chinese and gives operational instructions only in that language, with no indication that the user may choose another language or that the skill is region-specific. This creates a natural-language policy concern because it implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file authorizes automatic global installation of BrightData CLI as part of a preflight check, expanding the skill from research orchestration into host environment modification. Even if intended for convenience, auto-installing and then authenticating external tooling increases attack surface and can lead to unreviewed code execution or persistent system changes unrelated to the immediate user request.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Automatically installing @larksuite/cli and adding related skills modifies the local environment and broadens the skill's privileges into document-platform tooling management. In this skill, that is more dangerous because Feishu/Lark access can expose or alter organizational documents, and the installation path also executes third-party package code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
81% confidence
Finding

The checklist recommends running npx skills add ... -y -g without pinning a version or immutable artifact, which introduces supply-chain risk because the executed package/plugin can change over time. In a skill context that already encourages automatic environment modification, this makes it easier to pull and run unexpected code on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file is written entirely in Chinese and gives operational guidance without indicating that language choice is optional or user-driven. Under the policy rule for natural-language violations, forcing a specific language or locale without opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The fallback guidance authorizes automatic global installation of external tooling (@brightdata/cli, @larksuite/cli) even though the skill's purpose is research and document organization, not system administration. This expands the skill's operational scope into making persistent environment changes, increasing risk of unintended code execution, supply-chain compromise, and violating least-privilege expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document says to automatically run a global npm installation without clearly warning the user that this will modify the system environment. Hidden or implicit environment modification undermines informed consent and can lead to installation of untrusted code with persistent effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The fallback includes automatic installation of @larksuite/cli and an additional skill via npx, again without an explicit warning about system changes or code provenance. In this skill context, that is more dangerous because the agent is supposed to perform content research/output tasks, not bootstrap arbitrary tooling into the host environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The document instructs use of npx skills add against a remote GitHub source without any version pinning or integrity control. That creates a supply-chain risk: a future upstream change or compromised dependency could cause the agent to install and execute unexpected code during fallback handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Allowing the skill to automatically initialize a git repository and create an initial commit is outside the stated scope of batch research and document output. This can alter the user's workspace state, create misleading repository history, and normalize unrelated side effects in response to tooling failures.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Permitting automatic git initialization and an initial commit without a clear warning about repository changes allows the skill to mutate the user's project state silently. In practice this can interfere with workflows, create unwanted history, and mask that the skill exceeded its intended authority.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document states that the skill obtains Feishu/Lark document read/write capability and later provides commands that append or replace remote document contents, but it does not clearly warn that these actions modify user-controlled remote data. In a batch-research skill context, operators may run the workflow at scale, so unclear disclosure increases the risk of unintended remote data modification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The document instructs users to run npx skills add https://github.com/larksuite/cli -y -g without pinning a specific version, commit, or immutable release. That creates a supply-chain risk: future upstream changes or a compromised dependency could alter what gets installed, and this skill is explicitly granting document read/write capability, increasing the blast radius.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The auto-remediation section repeats the unpinned npx skills add https://github.com/larksuite/cli -y -g installation flow, again relying on mutable upstream content. Because this path is framed as an automatic fix during setup, users may execute it with less scrutiny, making supply-chain compromise more plausible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file presents all operational instructions and warnings only in Chinese, which effectively forces a specific language on users. Under the policy, language-specific constraints should either be optional, user-selectable, or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.