ClawHub
Back to skill

Security audit

Multilingual Learning Sprint

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent language-learning workflow, but its paid fulfillment scripts handle payment credentials and learner profile data with under-scoped URL controls.

Review this carefully before installing. The tutoring parts are straightforward, but only use the paid ClawTip/Alipay flow if you trust the backend and understand that learner profile data and payment credentials are used by local scripts and remote services. Avoid custom API base URLs or order files from untrusted sources.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (5)

Tainted flow: 'request' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
)

    try:
        with urllib.request.urlopen(request) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as error:
        response_text = error.read().decode("utf-8")
Confidence
97% confidence
Finding
The script sends a POST request to a URL derived from environment variables (LANGUAGE_SPRINT_API_BASE_URL or APP_BASE_URL) without validating or restricting the destination. Because the payload contains user learning-profile data, a tampered environment can redirect sensitive data to an attacker-controlled endpoint, creating a clear SSRF/data-exfiltration risk in deployment or CI environments.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill text directs use of local scripts, order files, backend calls, and payment workflows, which imply file read/write, network access, and likely environment-dependent execution, yet no permissions are declared. This creates a trust and review gap: an agent or platform may invoke capabilities the user did not expect, especially around payment fulfillment and local order storage.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code accepts resource_url/resourceUrl directly from order data and uses it as the POST destination while attaching the X-ClawTip-Pay-Credential header. This enables SSRF and credential exfiltration: a crafted order can cause the skill to send payment credentials and user learning data to an attacker-controlled endpoint instead of the intended service.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The manifest description is extremely broad and matches many ordinary language-learning and tutoring requests, increasing the chance of over-activation in contexts where the user did not intend to invoke this skill. Because the skill also includes payment and backend fulfillment flows, accidental triggering can expose users to unnecessary data collection, external service use, or payment prompts.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script transmits user-supplied profile fields such as target language, native language, current level, goal, interests, and sample answer to a remote service, but the CLI provides no explicit disclosure or consent prompt. This is a privacy issue because users may enter sensitive personal or educational information without realizing it will be sent off-device.

Static analysis

No suspicious patterns detected.