ClawHub
Back to skill

Security audit

生日提醒

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed birthday reminder tool that can send configured notifications, with privacy considerations but no hidden or malicious behavior found.

Install only if you are comfortable storing birthday records in local JSON files and, when enabled, sending reminder text to the configured services. Protect webhook URLs and bot tokens, use dry-run first, avoid shared or sensitive file output paths, and minimize personal details in messages sent to third-party platforms.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose emphasizes managing and calculating birthday reminders, but the documented behavior also includes acting as a notification bridge that writes files and sends outbound requests to multiple third-party services. This mismatch is dangerous because users and orchestrators may grant trust based on a benign-seeming description while the skill can exfiltrate message content or interact with external systems beyond the stated scope.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documents capabilities that read configuration files, write local files, and send notifications over the network, but it does not declare any explicit tool scope or permission boundaries. That creates an authorization ambiguity where a caller may assume a narrow 'birthday reminder' function while the skill can access filesystem and external endpoints, increasing the chance of unintended data exposure or misuse.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The display name, short description, and default prompt are all written exclusively in Chinese, which indicates a language-specific experience without any visible opt-in or justification. Under the language/locale policy, this is a natural-language policy concern unless the skill offers a language choice or clearly documents that it is intended only for a Chinese-language context.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
Most of the documentation is written in Chinese, including headings, constraints, examples, and configuration explanations, without indicating that another language is supported or that Chinese is required for a region-specific reason. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation explicitly supports outbound channels such as webhook, Slack, Telegram, Feishu, and DingTalk for birthday notifications, which can transmit personal data like names, dates, and reminder content to third-party services. While this is expected functionality, the absence of any warning about privacy, data minimization, secret handling, or third-party data exposure creates a real security/privacy weakness because users may configure external delivery without understanding the implications.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This code’s natural-language description, CLI help, errors, and output messages are written entirely in Chinese, indicating the skill is effectively limited to a specific language/locale. The file does not provide any user opt-in, alternate language option, or justification that this is intentionally region-specific.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
User-facing strings such as the module docstring, argument descriptions, and output messages are all Chinese, which imposes a language choice on users without opt-in. The file does not indicate that the skill is intentionally restricted to a Chinese-speaking or region-specific context.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
清单描述将该技能定位为生日提醒方案生成、配置维护、到期校验，并提到可“结合官方定时任务技能自动触发通知发送”，语义上更像为通知提供数据或配置支持。该文件却直接实现了 webhook、飞书、钉钉、Slack、Telegram 以及文件输出等实际发送能力，行为范围明显扩展到主动消息分发。

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script sends personal reminder content, including names, birthday details, and reminder times, to arbitrary configured webhooks and chat platforms without validation, consent checks, or destination allowlisting. In this skill context, birthday data is personal information, so misconfiguration or malicious configuration can silently exfiltrate sensitive data to third parties.

External Transmission

Medium
Category
Data Exfiltration
Content
def send_telegram(text: str, channel: dict) -> None:
    token = channel["bot_token"]
    url = f"https://api.telegram.org/bot{token}/sendMessage"
    post_json(url, {"chat_id": channel["chat_id"], "text": text})
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The description is written entirely in Chinese and states the skill '默认使用北京时间', establishing a fixed locale/timezone default without indicating user choice or opt-in. Under the policy rule, forcing a specific language or locale without offering choice can be a natural-language policy concern, especially for a generally applicable reminder skill.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
The default timezone is set to "Asia/Shanghai", which implies a specific locale preference in a natural-language-facing configuration without any indication that the user can choose or opt in to that locale. Under the policy rule, forcing a specific language or locale without user choice can be a natural-language policy concern.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The file sender appends reminder content to any configured filesystem path and creates parent directories automatically. While this is intended functionality, it can expose personal reminder data to unintended locations, shared directories, or sensitive log paths if the configuration is untrusted or mistaken.

Static analysis

No suspicious patterns detected.