ClawHub
Back to skill

Security audit

Qibook Company Wiki Deepresearch

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its company-research purpose, but it sends queries to an external API and contains report-template instructions that conceal AI authorship.

Install only if you are comfortable sending queried organization names to the configured QIBOOK service using your API key. Before customer-facing, legal, credit, investment, or compliance use, remove the instructions that hide AI authorship, validate or lock down QIBOOK_BASE_URL, and require explicit confirmation before external lookups for ambiguous user requests.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tainted flow: 'url' from os.environ.get (line 60, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
try:
        debug_print(f"调用聚合接口: {url}, 企业: {entname}")
        response = requests.get(url, headers=headers, params=params, timeout=timeout)
        result = response.json()

        if result.get('code') == 200:
Confidence
92% confidence
Finding
The request URL is built from QIBOOK_BASE_URL taken directly from the environment and then used in requests.get while sending the access_key header. If an attacker or unsafe deployment can influence that environment variable, the skill can be redirected to an attacker-controlled host, causing credential leakage and SSRF-style outbound requests. In this skill context, the risk is higher because the request includes both sensitive enterprise query data and an API credential.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The template is scoped to 个体工商户 while the skill metadata advertises company-level deep research. This mismatch can cause the agent to apply the wrong analytical framework, omit relevant corporate factors, or generate misleading reports for users who expect enterprise analysis; in compliance or due-diligence contexts, that can lead to materially incorrect decisions.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The file says analysis must be strictly based on user-provided data, but later requires policy-background, opportunity/challenge, and credit-risk analysis that may not be present in the supplied facts. That contradiction pressures the model to infer or hallucinate unsupported content, creating a risk of fabricated risk assessments or inaccurate compliance-relevant conclusions about a business.

Vague Triggers

High
Confidence
95% confidence
Finding
The activation guidance is intentionally broad and says vague requests like '了解一下' or unclear intent should still trigger the skill. That makes the skill prone to over-invocation, causing external data retrieval and report generation when the user did not clearly request this specific capability, which can lead to unnecessary disclosure of user queries to a third-party service and bypass user intent boundaries.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The CLI entrypoint prints up to 2000 characters of the returned enterprise data directly to stdout. In this skill's context, the fetched dataset may contain sensitive corporate, legal, contact, or credit-related information, and command-line output is commonly captured in terminal history, logs, CI job output, or shared consoles, making unintended disclosure plausible.

Natural-Language Policy Violations

High
Confidence
95% confidence
Finding
The instruction forbidding the model from letting customers notice it is AI is a deceptive behavioral constraint that pushes the agent to conceal its nature. This is dangerous because it encourages misrepresentation, can interfere with transparency or disclosure requirements, and may compound trust and compliance risks in a due-diligence context where users may rely on the report as expert human analysis.

Ssd 1

Medium
Confidence
98% confidence
Finding
The instruction '不允许让客户察觉到你是AI' explicitly tells the model to conceal its AI identity, which is a deceptive behavior requirement. This undermines transparency, can bypass user or platform expectations about disclosure, and may make downstream users place inappropriate trust in the report as if it were authored by a human expert.

Static analysis

No suspicious patterns detected.