ClawHub
Back to skill

Security audit

IP情报查询工具

Security checks for vulnerabilities and agentic risk

Overview

The skill looks like an API-backed IP lookup tool, but it needs review because it stores an API key in plaintext and includes unrelated documentation references that make its true scope less clear.

Install only if you are comfortable giving this skill an external API key and allowing local configuration writes. Before use, review where .env is created, keep it out of source control and backups, prefer an environment variable or secret store, rotate any key already saved there, and confirm the unrelated gaokao/school-query references are only documentation leftovers rather than active functionality.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation instructs use of environment access, local file read/write, and network operations, but no permissions are declared. This creates a transparency and consent gap: users and the hosting platform may not realize the skill can persist secrets locally and make external API calls. In this context, the risk is elevated because the skill explicitly asks for an API key and saves it via local configuration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill claims to be a focused IP intelligence tool, but the documentation also indicates local API-key persistence and references unrelated tooling and project naming, suggesting it may act as a more generic remote tool wrapper than advertised. Description-behavior mismatch is dangerous because it undermines informed consent and can conceal broader data handling or external communications than users expect.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The workflow example and project structure mention unrelated gaokao/school-query functions and directories, which directly conflict with the stated IP-intelligence purpose. Such inconsistencies are a security concern because they indicate copy-paste reuse or hidden broader functionality, making it harder to assess what data may actually be processed or where requests are sent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to ask the user for an API key and persist it using local configuration without clearly warning that the secret will be stored. Collecting and storing credentials without explicit disclosure, scope limitation, or secure handling guidance can lead to secret leakage, unintended reuse, and compromise of the user's external account.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code persists the API key in plaintext to a local .env file without warning, consent, or any file-permission hardening. On shared hosts, checked-in workspaces, backups, or developer machines, this increases the chance of credential disclosure and subsequent unauthorized API use.

Credential Access

High
Category
Privilege Escalation
Content
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
Confidence
90% confidence
Finding
This function explicitly reads and rewrites a plaintext .env file containing an API key, increasing the chance that credentials are left on disk, copied into backups, or accidentally committed to source control. In a skill context, where code may run on end-user or shared agent environments, silent local secret persistence is more dangerous than in a tightly managed server environment.

Credential Access

High
Category
Privilege Escalation
Content
def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()
Confidence
89% confidence
Finding
The function contract explicitly promises persistence of the API key to .env, normalizing insecure secret storage as part of regular operation. This can lead to long-lived plaintext credential exposure on disk and make secret leakage through repository sync, support bundles, or local compromise more likely.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
The dependency is specified with a lower-bound only (requests>=2.31.0), which allows future versions to be installed without review and also permits selection of the known-vulnerable 2.31.0 release. In a security-sensitive IP intelligence tool that performs network operations, dependency drift increases supply-chain and reliability risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
87% confidence
Finding
Using pydantic>=2.7.0 is an unpinned dependency pattern that permits unreviewed future versions to be installed, creating reproducibility and supply-chain risk. Even without a cited CVE here, loose versioning can introduce vulnerable or breaking versions into deployments.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
87% confidence
Finding
Using pydantic-settings>=2.2.0 leaves the resolved package version open-ended, which weakens build reproducibility and can unintentionally pull in unsafe or incompatible releases. This is a supply-chain hygiene issue rather than an immediate exploit by itself.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
94% confidence
Finding
The requirement python-dotenv>=1.0.1 is unpinned and also allows installation of 1.0.1 itself, which has a cited advisory. For a tool likely to handle configuration and secrets, loose dependency control around dotenv parsing increases operational and supply-chain risk.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium
Category
Supply Chain
Confidence
97% confidence
Finding
The requirement permits requests 2.31.0, which is associated with multiple advisories including credential leakage and request verification issues. Because this skill is an IP intelligence tool that likely makes outbound HTTP requests to external services, flaws in the HTTP client are more relevant and can expose credentials, alter trust decisions, or weaken request handling.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
82% confidence
Finding
The requirement allows python-dotenv 1.0.1, which is reported to have a symlink-following file overwrite issue in set_key. This becomes more dangerous if the skill ever updates .env files or runs with elevated filesystem permissions, though the severity remains limited based on the file alone.

Static analysis

No suspicious patterns detected.