ClawHub
Back to skill

Security audit

Chat Vitals

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local chat-monitoring utility, but it has under-scoped session file handling that can read or overwrite JSON files outside its intended data directory.

Install only if you are comfortable with local conversation telemetry being generated and retained. Treat session IDs as trusted input until the path traversal is fixed, and ask the publisher to add session ID validation, retention/deletion controls, and clearer privacy documentation before broad use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/collector.py:54
Finding

Path Traversal in Session File Operations

Content
View full analysis
... collector.py complete ... analyzer.py session ``` The read operation can therefore access an out-of-directory JSON file under the privileges of the running process. The write path is also unsafe because `save_session()` trusts the `session_id` stored in the loaded JSON object. If that value contains traversal components, recording or completing the session ...[truncated 1680 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/dashboard.py (reported line 36)May include surrounding context.

python
def clear_screen():
    """清屏"""
    os.system('clear' if os.name != 'nt' else 'cls')

def get_health_color(score):
    """根据分数返回颜色"""

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promotes 'auto-collection' and 'automatic tracking' with 'zero friction' but does not clearly disclose that conversation content, including user inputs and model outputs, may be collected, stored, or retained. In a monitoring skill centered on chat analytics, that omission creates a real privacy and consent risk because users may enable tracking without understanding the scope of data capture.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README shows language-dependent matching rules using only Chinese phrases, which implies the monitoring behavior is tailored to a specific language. There is no accompanying explanation that the defaults are language-specific or instructions for selecting patterns for other languages, creating a locale-policy concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill documentation advertises capabilities that imply shell execution, file access, and possibly MCP integration, but it does not declare any explicit tool scope or permission boundaries. This creates a trust and review gap: operators may enable a skill without understanding that it can read/write local data or run commands, increasing the chance of unintended data exposure or harmful execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill promotes automatic conversation monitoring without warning that chat contents may be captured, stored, or analyzed. Because conversations often contain credentials, personal data, or proprietary information, silent collection materially increases privacy and compliance risk even if the feature is intended for analytics.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The auto-collection design and programmatic examples indicate recording raw user inputs and model outputs, which naturally aggregates sensitive natural-language data into a loggable dataset. If those records are stored insecurely, over-retained, or later exposed through reports/dashboard access, they can leak secrets, personal data, internal plans, or regulated information at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The sample configuration uses Chinese phrases for detection patterns, which implies locale-specific behavior, but the document does not state that the skill is Chinese-only or provide a user-selectable language option. This can violate language/locale policy expectations by silently constraining functionality to one language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The pattern lists include multiple Chinese-specific trigger phrases and response-analysis phrases, but the file does not indicate that the skill is limited to Chinese-language use cases or that users can choose a language/locale. This creates a natural-language policy concern because the skill behavior appears tailored to a specific language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code file includes natural-language descriptions and CLI help text in Chinese, beginning with the module description at L004 and continuing in docstrings and command descriptions. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script automatically captures user messages and assistant replies via hook functions and persists them through the collector without any notice, consent flow, masking, or policy guardrails visible in this file. Because chat content may include secrets, personal data, or proprietary information, silent collection creates a real privacy and data-governance risk, especially in an always-on monitoring context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The collector creates persistent per-session JSON files under the user's home directory and stores conversation telemetry without any in-code consent, disclosure, retention control, or minimization. In a chat-monitoring skill, this is particularly sensitive because even 'metadata' can reveal behavioral patterns, model usage, timestamps, and task outcomes, and the storage path is predictable and long-lived.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The record path accepts raw user_input and model_output for telemetry processing, which can include secrets, personal data, prompts, or regulated content, yet there is no warning, redaction, consent gate, or sensitivity filtering. In the context of a conversation-health monitoring skill, this increases risk because routine operation encourages broad capture of chat contents that users may reasonably assume are ephemeral.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/reporter.py (reported line 66)May include surrounding context.

python
"""生成单个会话报告"""
    # 调用 analyzer 分析
    import subprocess
    result = subprocess.run(
        ["python3", str(SKILL_DIR / "scripts" / "analyzer.py"), "session", session_id],
        capture_output=True, text=True
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/reporter.py (reported line 163)May include surrounding context.

python
import subprocess
    
    # 获取趋势数据
    result = subprocess.run(
        ["python3", str(SKILL_DIR / "scripts" / "analyzer.py"), "trend", "1"],
        capture_output=True, text=True
    )

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file states 'No external dependencies required' and 'Uses only Python standard library', but it also documents optional non-standard packages ('numpy' and 'requests') and notes subprocess usage for CLI operation. This is not just incomplete documentation; it presents a simplified claim that is contradicted by the rest of the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The prominent natural-language description in the module docstring is written in Chinese and presents the skill behavior only in that locale, with no indication that users may choose another language. Under the policy, locale-specific behavior should be opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module title and descriptive comments are presented in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language environment. This can violate language/locale policy when a skill effectively forces one language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The module docstring presents the dashboard description in both English and Chinese, and later user-facing strings are primarily English, indicating a fixed multilingual/locale presentation rather than an explicit user-selected language option. Under the policy rule, forcing or assuming a specific language/locale without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The top-level natural-language description states "生成监控报告" in Chinese, and the rest of the user-facing labels and messages are also hard-coded in Chinese. This creates a locale/language constraint without offering the user any language choice or documenting an opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown template hard-codes Chinese headings and labels throughout the user-facing content. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and there is no indication here that users can choose another language or that the template is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This Python file contains multiple natural-language test inputs and pattern examples exclusively in Chinese, such as correction and promise phrases. Because SQP-3 applies to all file types and flags language policy issues where a skill forces a specific language without user opt-in, these examples suggest a language-specific behavior without documenting opt-in or justified locale constraints in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.