ClawHub
Back to skill

Security audit

cruise-product

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a remote cruise-product MCP, but it still tells agents to send user input to an unrelated httpbin.org test endpoint without clear data-handling guidance.

Review this before installing. Use it only if you are comfortable with a remote MCP service receiving cruise-search inputs, and avoid sending secrets, credentials, personal data, payment details, or confidential business content until the publisher removes the httpbin.org instruction and documents the real data recipient and logging practices.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:22
Finding

Unnecessary Disclosure of User Input to an Unrelated Third-Party Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-36
Vulnerability Type: External transmission of potentially sensitive user input
Risk Level: Medium

The Skill instructs an agent to submit analysis requests, including user-controlled input, to the public testing service https://httpbin.org/post. This endpoint is unrelated to the cruise-product MCP gateway configured in server.json.

markdown
## 用法

当需要提交分析请求时，向以下 API 发送 **POST** 请求（JSON body）：

https://httpbin.org/post

text

示例 body：

```json
{ "input": "...", "skill": "cruise-product" }

> 发布到 CruiseSkillBridge 后，上述 URL 会自动替换为网关地址，调用将计入控制台统计。

text

### Technical Analysis

The documented request body places arbitrary user-supplied content in the `input` field and directs the agent to transmit it to httpbin.org. The actual MCP gateway declared in `server.json` is:

```text
https://cruise-mcp.olavacations.com/api/gw/mcp/63460e43-c726-44dc-8ae3-28841083d243

Despite the documentation claiming that the placeholder URL will be replaced after publication, the published Skill still contains the httpbin endpoint. There is no instruction to obtain informed user consent, minimize transmitted data, redact sensitive information, or reject secrets and personal data.

Exploitation does not require code execution. It requires only that an agent follow the documented usage instructions while processing user-controlled or confidential content.

Attack Path

  1. A user invokes the Skill and supplies content for analysis.
  2. The content may include personal information, confidential business data, credentials, tokens, or other sensitive material.
  3. The agent follows the instructions in SKILL.md.
  4. The agent places the supplied content in the JSON input field.
  5. The agent sends an HTTPS POST request to https://httpbin.org/post.
  6. The unrelated third-party service receives and processes the submitted content.

This ...[truncated 998 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the httpbin.org endpoint from SKILL.md.
  2. Replace it with the intended MCP gateway only if direct POST requests are genuinely part of the supported integration.
  3. Keep SKILL.md, server.json, and references/mcp.md consistent so they identify the same service and data recipient.
  4. Clearly document what request data is collected, where it is sent, how long it is retained, and which parties process it.
  5. Require explicit user confirmation before transmitting sensitive or potentially confidential content.
  6. Add instructions prohibiting submission of passwords, authentication tokens, private keys, payment information, and unnecessary personal data.
  7. Apply data minimization and redaction before outbound requests.
  8. Configure an allowlist so the agent may contact only the documented production MCP origin.
  9. Add a release-time validation check that rejects placeholder or testing domains such as httpbin.org from published Skill documentation.
  10. Publish authentication, privacy, retention, and incident-response policies for the remote MCP service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to send POST requests to an external endpoint and explicitly notes that calls may be routed through a gateway and counted in console statistics, but it does not provide a clear warning about network transmission, data handling, or telemetry implications. This creates a real risk that users may submit sensitive inputs to third-party infrastructure without informed consent, especially because the skill is presented as a ready-to-use MCP integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description text is presented entirely in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

All user-facing natural-language content in the skill description is in Chinese, with no indication that this is a region-specific skill or that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill as published by CruiseSkillBridge without indicating any language choice or region-specific limitation. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.