ClawHub
Back to skill

Security audit

qianfan clawhub

Security checks across malware telemetry and agentic risk

Overview

This is a marketplace installer for Baidu Qianfan skills, but its install path and ZIP extraction are not safely constrained enough for automatic trust.

Install only if you trust the Baidu Qianfan endpoint and the specific skills being downloaded. Avoid --force and custom/shared workdirs unless you have reviewed the destination, and do not use this in a sensitive workspace until ZIP path validation and stricter install-directory containment are added.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares required binaries and an API key in metadata, and its documented behavior performs remote search and installation, which implies network and environment access without an explicit permissions declaration. This creates a transparency and governance problem: users and policy engines may not fully understand the skill's effective capabilities before use, especially because it downloads and installs external content.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code queries an unauthenticated localhost HTTP service and trusts its JSON response to determine the workspace directory. Any local process able to bind or intercept localhost:4096 can influence where downloaded skill files are written, enabling file placement in attacker-chosen locations and increasing the risk of local privilege misuse or persistence.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The installer downloads an arbitrary ZIP from a remote endpoint and writes its contents to disk without validating archive member paths. A malicious archive can use path traversal sequences like ../ or absolute paths to escape the intended skill directory and overwrite other files, which is a classic Zip Slip vulnerability.

Self-Modification

High
Category
Rogue Agent
Content
# Install to default location (~/.qianfan/workspace/skills/)
python3 scripts/qianfanclawhub.py install "baidu-search"

# Force overwrite existing skill
python3 scripts/qianfanclawhub.py install "ai-ppt-generate" --force

# Install to custom directory
Confidence
91% confidence
Finding
overwrite existing skill

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.