ClawHub
Back to skill

Security audit

entropy-box-zh

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese-language robotics research skill that uses an external public API for technical search and consultation, with explicit safety limits and consent guidance for sensitive context.

Install only if you are comfortable sending robotics or embodied-intelligence queries to the listed public API. Do not include secrets, customer data, proprietary designs, internal identifiers, or personal information unless you intentionally approve that disclosure after redaction.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The manifest sets `language: "zh-CN"`, which indicates a fixed language/locale for the skill. Under the policy rule, forcing a specific language is a violation unless the skill offers a language choice or clearly justifies the locale constraint; this file does neither.

External Transmission

Medium
Category
Data Exfiltration
Content
`POST /api/search`

```bash
curl --fail-with-body --silent --show-error \
  --max-time 60 \
  -X POST "https://xiangshang.ngrok.app/api/search" \
  -H "Content-Type: application/json" \
Confidence
90% confidence
Finding
This documentation instructs the agent to transmit user-supplied queries to an external public endpoint (`https://xiangshang.ngrok.app/api/search`) without authentication and explicitly states the public API requires no key. That creates a real data-exfiltration/privacy risk if prompts, project details, or sensitive technical requirements are forwarded off-platform, especially because the guidance encourages sending natural-language engineering requests to a third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
`POST /api/evidence/search`

```bash
curl --fail-with-body --silent --show-error \
  --max-time 60 \
  -X POST "https://xiangshang.ngrok.app/api/evidence/search" \
  -H "Content-Type: application/json" \
Confidence
90% confidence
Finding
The evidence-search example sends free-form technical questions to the same external public service. Because this endpoint is meant for detailed evidence gathering, users may include sensitive architecture, roadmap, or research context, so the skill creates a real risk of unintended disclosure to a third-party operator.

External Transmission

Medium
Category
Data Exfiltration
Content
优先使用 `POST /api/lookup`。

```bash
curl --fail-with-body --silent --show-error \
  --max-time 60 \
  -X POST "https://xiangshang.ngrok.app/api/lookup" \
  -H "Content-Type: application/json" \
Confidence
88% confidence
Finding
The lookup endpoint also transmits identifiers, keywords, and potentially sensitive internal entity names to an external ngrok-hosted service. Even though lookup seems narrower than search, internal capability IDs, asset names, or proprietary terminology can still leak confidential information or reveal internal system structure.

External Transmission

Medium
Category
Data Exfiltration
Content
`POST /api/consult`

```bash
curl --fail-with-body --silent --show-error \
  --max-time 200 \
  -X POST "https://xiangshang.ngrok.app/api/consult" \
  -H "Content-Type: application/json" \
Confidence
93% confidence
Finding
The consult endpoint is the most sensitive because it encourages sending complete engineering problems, constraints, and prior context (`prev_context`) to an external service, with long-running processing by backend and LLM assembly components. This substantially increases the chance of disclosing proprietary designs, internal workflows, customer data, or confidential system constraints to a third party, making the context more dangerous than the simpler search endpoints.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file title and operative instruction are entirely in Chinese, and line L03-L04 instructs the agent to read this file for relevant tasks without providing any language-selection option. This creates a locale/language policy concern because it implicitly requires Chinese comprehension or output with no user opt-in or documented regional constraint.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This markdown file contains user-facing instructions only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The file title and all operational guidance are written in Chinese, while the policy category calls out language or locale constraints that force a specific language without user opt-in. Although the API itself states it supports both Chinese and English, the documentation presented to users does not offer a language choice or note that an alternate language version is available.

Static analysis

No suspicious patterns detected.