ClawHub
Back to skill

Security audit

librag-recall

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward LibRAG knowledge-base lookup skill, with expected local config use and network calls that are disclosed for its purpose.

Before installing, replace the placeholder API key with a scoped LibRAG key, keep config.json private, confirm base_url points to the intended LibRAG service, and use the skill only with knowledge bases whose retrieved source text may be shown to the agent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly instructs use of a local Python script that reads `config.json` and performs network requests to a LibRAG endpoint, yet it declares no permissions or equivalent capability disclosure. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may treat the skill as less privileged than it really is, increasing the chance of unintended file access or outbound requests with sensitive configuration such as API-bound knowledge base access.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger phrases are broad, natural-language expressions such as '去知识库里查一下' and '从文档中找到答案', which can overlap with ordinary user requests. Over-broad activation can cause the skill to run in situations the user did not specifically intend, leading to unnecessary retrieval against a configured knowledge base and possible exposure of internal corpus contents or metadata.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.install_untrusted_source

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/recall.py:138

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
config.json:2