ClawHub
Back to skill

Security audit

Knowledge Rag

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local knowledge-base tool, but its unauthenticated local web service can expose filesystem browsing and knowledge-index controls too broadly.

Install only if you are comfortable running a local web service that indexes personal documents. Keep it bound to localhost, avoid leaving it running on untrusted networks, do not index secrets or highly sensitive files, review any save-to-knowledge-base action before allowing persistence, and prefer safer verified Ollama/package installation steps over direct remote shell execution.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (15)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if not os.path.isdir(node_modules):
        print_status("首次启动，正在安装网页依赖...", "wait")
        try:
            subprocess.run(
                ["npm", "install", "--no-audit", "--no-fund"],
                cwd=TS_DIR, check=True, timeout=120,
            )
Confidence
77% confidence
Finding
Automatically running npm install on startup executes package lifecycle scripts from the local web project and pulls code from the package ecosystem. If the project dependencies or lockfile are tampered with, or a malicious package is introduced, this becomes a supply-chain execution path on the user's machine.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
else:
            print_status(f"推荐模型 {expected_model} 未安装，正在自动下载...", "wait")
            try:
                subprocess.run(["ollama", "pull", expected_model], check=True, timeout=300)
                print_status(f"模型 {expected_model} 下载完成", "ok")
            except Exception as e:
                warnings.append(f"模型下载失败: {e}，请手动运行: ollama pull {expected_model}")
Confidence
82% confidence
Finding
The script automatically pulls a model from Ollama based on local configuration and then uses it. Although not shell-injectable, this is still code/content acquisition from an external source triggered by startup, which introduces supply-chain and trust risks if the configured model source is untrusted or has been altered.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises and documents capabilities including shell execution, network access, file reads/writes, and environment interaction, yet no explicit permissions are declared. This creates a transparency and consent gap: users or the host platform may not realize the skill can install software, write persistent data, and access local files.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The stated purpose is a personal knowledge base, but the documented behavior includes a local web service, directory enumeration, configuration mutation, index deletion, and model-management/network actions. These extra capabilities materially expand the attack surface and can expose or modify more of the user's local environment than the description implies.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The /api/browse endpoint accepts an arbitrary path parameter, defaults to the user's home directory, and returns directory names and absolute paths from anywhere on the local filesystem. That exceeds the stated knowledge-base search/save purpose and creates an information disclosure surface that can reveal sensitive directory structure unrelated to the knowledge repository.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The /api/delete-file endpoint performs unauthenticated destructive deletion of index entries by filename, optionally filtered by source_type. Even though it deletes index rows rather than underlying files, it allows data tampering and loss of searchability beyond the advertised save/search behavior, which could be abused by any caller that can reach the API.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The /api/browse endpoint exposes arbitrary local directory listings rooted effectively at any path the process can read, not just the knowledge base directory. In a local agent/web skill context, this leaks filesystem structure and sensitive path names that can aid further attacks or reveal private user data unrelated to the skill’s stated purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The server sets Access-Control-Allow-Origin: * and exposes GET/POST/DELETE endpoints without authentication, enabling any website visited by the user to make requests to the local service. Combined with /api/browse, a malicious site can enumerate the user’s local filesystem via the browser and potentially interact with other state-changing endpoints.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The README encourages users to ingest personal notes and documents into a searchable local knowledge base, but it does not clearly warn that those contents become queryable through a web UI and AI-assisted retrieval flow. In the context of a knowledge-RAG skill handling sensitive local documents, missing privacy guidance can lead users to expose private material to other local users, browser sessions, or downstream agent prompts without understanding the risk.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrase for saving content to the knowledge base is broad and conversational, making accidental activation plausible during normal dialogue. That can lead to unintended persistence of sensitive user text and automatic indexing without a clear, explicit save confirmation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to save user-provided content and update the index, but does not require an explicit warning that this creates persistent local files. Users may disclose sensitive material in chat without realizing it will be written to disk and later become searchable.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The endpoint executes a direct DELETE against the chunks table with no confirmation, safeguards, or access control visible in this file. Lack of warning alone is a UX issue, but here it accompanies an exposed destructive API, making accidental or unauthorized index deletion plausible and harmful.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The directory browsing API returns local filesystem structure with no warning, consent flow, or scope limitation, increasing the chance that users unknowingly expose private folder names and locations. In this skill, the feature goes beyond simple note search and broadens visibility into the host environment.

External Script Fetching

High
Category
Supply Chain
Content
```bash
# 1. 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 2. 拉取推荐模型（千问3 Embedding，中文最优）
ollama pull qwen3-embedding:8b
Confidence
97% confidence
Finding
The installation instructions fetch a remote script over the network and execute it directly via the shell. This is dangerous because any compromise of the remote server, CDN, DNS, TLS trust chain, or the script itself results in immediate arbitrary code execution on the user's machine.

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# 1. 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 2. 拉取推荐模型（千问3 Embedding，中文最优）
ollama pull qwen3-embedding:8b
Confidence
98% confidence
Finding
The `| sh` pattern is a classic command-chaining anti-pattern that turns a network fetch into immediate code execution with no verification or review step. In this skill's context, the command appears in setup instructions, so a user following documented installation steps could be exposed to supply-chain compromise or malicious script substitution.

Static analysis

No suspicious patterns detected.