ClawHub
Back to skill

Security audit

Web Scout

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for broad web collection, but it asks users to install mutable remote code and provide live session cookies to the agent.

Review before installing. Use dry-run or safe mode first, install only the platforms you need, prefer pinned commits/releases and pinned Docker digests, and avoid giving real account cookies to the agent unless you fully trust the upstream tools and local environment. Use throwaway accounts where possible.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:39
Finding

Mutable Remote Package Is Downloaded and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:43
Finding

Automatic Dependency Installation Executes Unreviewed Transitive Components

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:82
Finding

Unpinned Docker Image Allows Mutable Third-Party Code Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
95% confidence
Finding

The skill directs users to install and later upgrade software directly from a remote GitHub ZIP URL and then perform automatic dependency installation. This is dangerous because it bypasses stronger package provenance controls and can bootstrap execution of unreviewed remote code or dependencies, increasing supply-chain compromise risk.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

X | xreach (bird) | ✅ | 需 Cookie | | 📖 Reddit | JSON API + Exa | ✅ | 服务器需代理 | | 📕 小红书 | xiaohongshu-mcp | ✅ | 需 Docker + Cookie | | 🎵 抖音 | douyin-mcp-server | ✅ | 需 MCP 服务 | | 💼 LinkedIn | linkedin-mcp | ✅ | 需浏览器登录 | | 🏢 Boss直聘 | mcp-bosszp | ✅ | 需扫码登录 |

安装

第一步：安装 Agent Reach CLI

bash
pip install https://github.com/Panniantong/agent-reach/archive/main.zip

第二步：自动安装依赖

默认模式（自动安装所有依赖）：

bash
agent-reach install --env=auto

安全模式（只检查不安装，适合生产环境）：

bash
agent-reach install --env=auto --safe

预览模式（只看会做什么）：

bash
agent-reach install --env=auto --dry-run

第三步：检查状态

bash
agent-reach doctor

第四步：按需配置平台

需要 Cookie 的平台建议使用小号，避免封号风险。

Cookie 导出方法：浏�

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly tells users to export full session cookies and send them to the agent, which exposes live authentication credentials to the AI and any connected tooling, logs, or operators. If those cookies are reused or leaked, an attacker could hijack accounts on Twitter/X or other platforms without needing a password or MFA challenge.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file consistently presents the skill name, description, setup steps, and safety notes in Chinese, and does not indicate that users can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
78% confidence
Finding

The skill instructs users to run a Docker image by name only (xpzouying/xiaohongshu-mcp) without pinning a tag or immutable digest. This creates a supply-chain risk because future image changes or a compromised publisher account could cause users to pull and run unexpected code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.