ClawHub
Back to skill

Security audit

抖音流量分配大盘

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed API-backed Douyin traffic dashboard runner, with the main caution that it sends requests using an API key to an external service.

Install only if you are comfortable using an AISKILLS_API_KEY and sending this skill's requests to ai-skills.ai or any custom AISKILLS_BASE_URL you configure. Prefer explicit invocation for Douyin traffic analysis so it is not selected for unrelated conversations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions, but its documentation clearly indicates use of environment variables and outbound network access to call the AI Skills API. This creates a permission/capability mismatch: reviewers or policy engines may assume the skill is passive when it actually depends on secrets and external communication. In this context, the behavior appears expected for the skill’s function, but undeclared capabilities still reduce transparency and can enable misuse or accidental overtrust.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The manifest enables implicit invocation and pairs it with a very generic default prompt, but provides no clear trigger constraints or scoping conditions. This can cause the skill to be auto-selected in loosely related conversations, exposing user inputs to a skill that analyzes business/content strategy data even when the user did not explicitly request it.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.