Coze Studio

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill does not show data theft or destructive behavior, but it is flagged for review because it advertises a full Coze Studio platform while the included scripts are only placeholder or generic local utilities.

Review this carefully before installing if you expect real Coze Studio functionality. The visible code appears low-impact and local-only, but it is not the advertised AI agent development platform; avoid entering sensitive information and prefer the official Coze Studio source if that is what you need.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI09: Human-Agent Trust Exploitation

What this means

A user may trust the skill as a Coze Studio integration or development platform even though the provided artifacts are only a placeholder/generic utility.

Why it was flagged

SKILL.md advertises "Core functionality from coze-dev/coze-studio" and an AI agent development platform, but the primary run path is explicitly unimplemented and scripts/script.sh labels itself a "Multi-purpose utility tool." This is a material purpose/capability mismatch that could mislead users about what they are installing.

Skill content

run)
        echo "TODO: Implement main functionality"

Recommendation

Do not treat this as the official or functional Coze Studio platform without additional verification; the publisher should either implement the advertised functionality or clearly describe the skill as a placeholder/local utility.

Low

#ASI06: Memory and Context Poisoning

What this means

Text passed to the utility, including accidental secrets, may be stored in local data or history files.

Why it was flagged

The script persists user entries and command history locally. This is not exfiltration, but users should know that arguments and added data can remain on disk.

Skill content

DATA_DIR="${COZE_STUDIO_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/coze-studio}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Recommendation

Avoid entering secrets or private data into the command arguments, and review or clear the configured data directory if needed.