ClawHub
Back to skill

Security audit

全国招中标信息、政府采购项目查询-保标招标

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent bid-search API helper that discloses its API key and network use and shows no hidden persistence or destructive behavior.

Install only if you intend to use the Baobiao bid-search API and can provide a dedicated BAOBIAO_ZTB_API_KEY. Keep the API key out of logs and code, and do not override the script's base URL or key environment variable unless you are deliberately testing a trusted endpoint.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs the agent to read environment variables, local reference files, and make outbound network calls, but it does not declare permissions or capability boundaries. This creates a transparency and containment problem: an operator may approve or run the skill without realizing it can access secrets like API keys and exfiltrate data over the network to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.