技能更新管理器

• Outcome: Review
• Latest audit: May 28, 2026 · 1:11 PM UTC
• Version: 1.0.1

Overview

This is mostly a skill update manager, but it needs review because running it can persist changes in a shared MEMORY.md file and contact remote update URLs.

Install only if you are comfortable with a skill that can modify shared MEMORY.md and guide skill updates. Keep update checks disabled unless needed, inspect MEMORY.md after first use, provide only trusted update URLs, and approve any git clone or download update step separately after reviewing the source.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read and write local files and make outbound network requests, but it declares no permissions or equivalent user-visible capability boundaries. This creates a transparency and consent problem: a user may invoke what appears to be a simple registry/update helper without realizing it can modify MEMORY.md, inspect skill archives, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The declared purpose sounds like administrative tracking, but the instructions also authorize automatic workspace modification, archive parsing, metadata extraction, and remote fetching/scraping. That gap increases the risk of unintended side effects and unsafe trust decisions, especially because parsing untrusted .skill packages and writing MEMORY.md are security-relevant behaviors not clearly surfaced as sensitive actions.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is scoped as a skill registry/update manager, but it targets a workspace-wide MEMORY.md outside its own data file and can change shared agent state. Cross-scope modification of a global memory file increases the blast radius of this skill and can influence unrelated behavior or policy in the broader workspace.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The constructor performs side-effecting initialization by automatically appending configuration to MEMORY.md on object creation, even for read-oriented actions like list or extract. This violates least surprise and allows simply invoking the tool to alter persistent workspace state without a specific user request.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The code claims append-only behavior but opens MEMORY.md with write mode and rewrites the entire file content. Misleading documentation around file mutation is dangerous because users and reviewers may approve the skill under a false assumption about how much of a shared file it can modify or destroy.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The update_config docstring says it only appends and does not overwrite, but the implementation can rewrite existing MEMORY.md content through _update_existing_config. In a shared memory file, this mismatch can lead to unintended corruption or unauthorized alteration of user-maintained instructions.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger conditions are broad enough that the skill may run during many normal installation or startup flows, increasing the chance of unintended file modification and external requests. In a skill that can auto-initialize MEMORY.md and perform update checks, ambiguous invocation expands the attack surface and reduces meaningful user consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Automatic writes to MEMORY.md occur without an explicit warning or consent at the point of modification. Hidden persistence in a shared workspace file is risky in an agent skill because it can silently alter future agent behavior and create difficult-to-audit state changes.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script makes outbound requests to GitHub during update checks without strong user-facing disclosure at execution time. In an agent context, silent network access can leak installed skill identifiers, update URLs, and environment usage patterns to external services.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The ClawHub version check performs outbound requests to arbitrary skill-provided URLs without clear disclosure. Because update_url can be influenced by registration input, this creates SSRF-like risk to internal or sensitive endpoints if the tool runs in a trusted network environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. 读取 `MEMORY.md` 配置，判断更新检查是否启用
2. 如果启用，遍历所有已注册技能
3. 根据技能来源类型调用对应的版本检查逻辑：
   - **GitHub**：访问 `https://api.github.com/repos/{owner}/{repo}/releases/latest`
   - **ClawHub**：访问技能页面，解析 "Current version" 字段
4. 对比本地版本与远程版本
5. 返回有更新的技能列表

• Confidence: 76% confidence
• Finding: The skill performs outbound requests to GitHub and arbitrary user-provided update pages to retrieve version information. While update checking is part of the stated function, external transmission is still security-relevant because it can disclose installed-skill inventory and create SSRF/privacy risks if update URLs are untrusted or insufficiently constrained.

Static analysis

No suspicious patterns detected.