ClawHub
Back to skill

Security audit

AI图片视频音乐语音配音数字人口播换装超分剪辑全能创作插件市场

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed client and documentation package for a third-party AI creation API, with some privacy and credential-handling cautions users should consider.

Install only if you intend to use the a7w.cn service and are comfortable sending prompts, media URLs, optional uploaded files, document URLs, and your API key to that provider. Use environment variables or the chmod-protected login file rather than pasting secrets into shell history, monitor account charges, and only submit voice samples, likenesses, documents, or other media that you have rights and consent to process.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Tainted flow: 'req' from os.environ.get (line 78, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/a7w.py (reported line 80)May include surrounding context.

python
for attempt in range(RETRIES):
        req = urllib.request.Request(url, data=data, headers=headers, method=method)
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                return json.loads(resp.read().decode("utf-8", "replace") or "{}")
        except urllib.error.HTTPError as exc:
            text = exc.read().decode("utf-8", "replace")

Tainted flow: 'req' from os.environ.get (line 78, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The save(url, path) helper fetches an arbitrary URL and writes the response to a local path without validating the scheme, host, destination path, or response size. If an attacker can influence the returned URL or the caller passes untrusted input, this can enable SSRF-like outbound requests, access to internal services or local file URLs supported by urllib, and arbitrary file overwrite on the local system.

Content

Scanner excerpt · scripts/a7w.py (reported line 218)May include surrounding context.

python
if not url:
        raise A7wError("没有可下载的地址")
    req = urllib.request.Request(url, headers={"User-Agent": "a7w-skill/1.0"})
    with urllib.request.urlopen(req, timeout=300) as resp:
        data = resp.read()
    Path(path).write_bytes(data)
    return path

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明描述的是一个聚合型 AI 创作调用能力集合，核心承诺是可通过一个 Key 使用大量生成/编辑类插件与接口完成内容创作全流程。而提供的代码只实现了市场信息浏览：获取插件列表、分组展示、关键词搜索、查看接口参数。虽然代码会访问插件市场 API，且与“接口清单、参数表”部分有一定相关性，但其主要行为并不是调用这些 AI 能力本身，而是做目录/元数据查询工具。因此代码的实际主用途与声明的主要用途存在实质性不一致，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The voice cloning section describes cloning voices and submitting reference audio without any consent or biometric privacy warning. Voiceprints are sensitive biometric-like data, and misuse can enable impersonation, fraud, social engineering, or non-consensual synthesis of a person's voice.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The AI singing and voice-conversion endpoints accept both reference and source audio, yet the documentation provides no warning about consent, privacy, or potential misuse. In this context, the capability directly supports identity mimicry and unauthorized transformation of a person's voice, increasing risks of deception, harassment, and misuse of personal audio data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README explicitly instructs users to persist an API key locally via ~/.a7w/config.json without warning that the key is a secret or giving secure-storage guidance. This can lead users to store long-lived credentials in plaintext on shared machines, in backups, or in home directories with weak permissions, increasing the chance of credential theft and unauthorized API usage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises and documents capabilities involving network access, environment variable access, file reads/writes, and shell usage, but it does not declare enforceable tool scope in metadata. That creates a permission-boundary gap: a host may grant broader execution than users expect, making secret access, file access, or outbound requests possible without clear policy constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to pass the API key directly on the command line using --key sk-.... Command-line arguments are commonly exposed via shell history, process listings, terminal logging, and remote support captures, which can leak long-lived credentials to other local users or monitoring systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

python3 scripts/a7w.py call nano_banana create --json '{"prompt":"一只戴墨镜的柴犬"}'

text

### 直接 curl

```bash
curl -sS -X POST "https://api.a7w.cn/api/v1/apps/nano_banana/create" \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is natural-language documentation, and the title and all subsequent content are written exclusively in Chinese. Per the policy rule, forcing a specific language without user opt-in is a locale/language policy violation when no explicit justification or alternative is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This catalog documents media upload and remote-fetch features using public URLs and upstream asset ingestion, but does not warn users that their files and URLs will be transmitted to third-party services. That omission creates a real privacy and data-handling risk because users may submit sensitive images, audio, or video without informed consent or understanding of external retention and processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file Q&A feature sends public document URLs for remote analysis, but the catalog does not warn that document contents may be fetched, transmitted, stored, or processed by external services. Users may mistakenly provide sensitive or access-controlled materials exposed via public links, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring and all user-facing help/instructions are written only in Chinese, and the script emits Chinese-only status and error messages throughout the CLI flow. Because the file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience, it can violate the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 76)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 106)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 116)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/a7w.py (reported line 56)May include surrounding context.

python
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/a7w.py (reported line 97)May include surrounding context.

python
"没有找到 API Key。三种方式任选一种：\n"
        "  1) 命令行加 --key sk-xxxx\n"
        "  2) 设置环境变量 A7W_API_KEY\n"
        "  3) 到 https://api.a7w.cn/ 注册领取 Key（新用户有赠送点数）")


def _request(method, url, key, body=None, raw=None, content_type=None, timeout=180):

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The explanatory section is entirely in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The entire README is presented only in Chinese and does not indicate that language selection is optional or that the skill is intentionally restricted to Chinese-speaking users for a documented regional reason. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.