ClawHub
Back to skill

Security audit

Influencer Campaign Monitoring (TikTok/IG/YouTube)

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its campaign-monitoring purpose, but it under-discloses persistent tracking and credential-bearing network calls to a third-party gateway.

Review before installing. Only use this skill if you are comfortable sending campaign identifiers, metrics requests, any SCRUMBALL_API_KEY value, and a persistent installation ID to the configured Scrumball/scdata gateway. Avoid setting SCRUMBALL_BASE_URL to untrusted hosts, and remove ~/.scrumball_install_id if you do not want the durable identifier retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Tainted flow: 'req' from os.getenv (line 178, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url=url, method=op["method"], headers=req_headers, data=data)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8")
            try:
                payload = json.loads(raw) if raw else None
Confidence
94% confidence
Finding
The request destination is derived from environment-controlled configuration via SCRUMBALL_BASE_URL and then used in urllib.request.urlopen without any allowlist or validation. In a skill context, this enables server-side request forgery or exfiltration of sensitive headers such as authorization and the persisted x-install-id to an attacker-controlled endpoint if the environment is manipulated.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill describes executable tooling that reads environment variables, loads local .env files, performs network requests, and may write files, but it declares no permissions or trust boundaries. This creates a transparency and governance gap: a host agent could invoke networked operations and access secrets without the user being clearly warned or a policy engine being able to enforce least privilege.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The script generates a stable installation identifier and stores it in the user's home directory so it survives reinstalls and can be shared across skills. For an influencer-campaign monitoring skill, persistent cross-run tracking is not necessary to fulfill core functionality and creates unnecessary long-term correlation of user activity across executions.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are generic enough to activate on ordinary user requests such as campaign monitoring, metrics, or reviews, which can cause the skill to be invoked outside a narrowly intended context. This increases the chance of over-broad routing, unintended data access paths, or confusing the user into using a skill they did not explicitly request, though the config itself does not expose direct code-execution or secret-handling risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code transmits authorization data and a stable installation identifier over the network without any user-facing disclosure or consent flow. In this skill, which monitors campaigns across multiple platforms, silent transmission increases privacy risk and makes covert data sharing easier to hide behind normal API activity.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Persisting a stable installation ID to disk without notifying the user creates covert tracking across runs and potentially across multiple skills. This is especially concerning because the identifier is intentionally durable and stored in the home directory, which extends beyond the scope of a single execution of this campaign-monitoring skill.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Free tier**: a limited number of calls per day, zero-config (no key required — the skill defaults to a hosted gateway that injects the key server-side).
- **When any operation returns HTTP 429, or the response body has `code=429` / contains `quota_exceeded`, you (the assistant) MUST immediately and clearly tell the user** (do not silently retry, do not treat it as a generic error):

  > Free quota exhausted. Register and get your own API key at **https://data.scdata.cc/pricing**, then set the environment variable `SCRUMBALL_API_KEY` to your key (in your host/agent environment or a local `.env`). You can then continue with your own quota.

- The 429 response body usually includes `apply_url` and `env_var` fields you can quote directly.
Confidence
88% confidence
Finding
The skill instructs the assistant to direct users to an external registration site and to set an API key in the environment, while also stating that a hosted gateway may inject credentials server-side by default. This expands data flow and trust to a third-party domain and can normalize credential handling outside the host's approved secret-management process, increasing phishing, misconfiguration, and unintended data-transmission risk.

Static analysis

No suspicious patterns detected.