ClawHub
Back to skill

Security audit

本地知识库智能问答

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cloud-backed knowledge-base tool, but users should understand that documents and questions are sent to Alibaba Cloud services.

Install only if you are comfortable uploading the selected knowledge-base documents and queries to Alibaba Cloud DashVector/Bailian. Use a dedicated low-privilege API key, keep config.json private, specify --kb-path explicitly, and avoid indexing confidential or regulated material unless your organization approves that cloud processing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to execute Python scripts, read local documents, write reports/mindmaps, and call external APIs, which are code-capable behaviors involving file read, file write, and network access. Because these capabilities are not explicitly declared via a permissions model, users and the platform may not have clear visibility or enforcement over what the skill can access or transmit, increasing the risk of unintended local data exposure or exfiltration from the knowledge-base workspace.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill is described as a local knowledge-base QA tool, but it sends user questions to an external embedding API and relies on a remote vector service. This can exfiltrate sensitive document-derived queries and metadata off-host, violating user expectations and potentially organizational data-handling requirements.

Context-Inappropriate Capability

Low
Confidence
83% confidence
Finding
The auto-discovery logic searches the current directory, subdirectories, and then the parent directory's children for any folder containing raw_docs and config.json. In a multi-project or shared workspace, this can cause the script to operate on an unintended knowledge base, exposing unrelated local data without the user's explicit selection.

External Transmission

Medium
Category
Data Exfiltration
Content
}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        if response.status_code == 200:
            result = response.json()
            return result["data"][0]["embedding"]
Confidence
96% confidence
Finding
This request transmits the user's query text to an external embedding service. Because knowledge-base questions often contain confidential content, filenames, internal terminology, or excerpts from private documents, this creates a direct data exfiltration path inconsistent with a supposedly local QA skill.

External Transmission

Medium
Category
Data Exfiltration
Content
}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        resp_data = response.json()

        if resp_data.get("code") == 0:
Confidence
91% confidence
Finding
This request sends the generated vector and partition selection to a remote DashVector endpoint for search. Even if raw document text is not sent in this specific call, embeddings can still leak semantic information and the service returns document content back over the network, expanding exposure of sensitive knowledge-base material to third-party infrastructure.

Static analysis

No suspicious patterns detected.