ClawHub
Back to skill

Security audit

D4 World Boss Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it claims, but its optional cron-based reminder is a persistent host change that is not scoped or reversible enough for automatic installation.

Install only if you are comfortable with a Chinese-language Diablo IV helper that fetches data from map.caimogu.cc and may ask to create cron reminders. Before allowing reminders, require the agent to show the exact cron entry, confirm it is one-time or bounded, and provide the removal command.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_boss.py:17
Finding

Unsanitized Remote Content Is Emitted into the Agent Context

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch_boss.py, lines 17–26 and 64–65
Vulnerability Type: Improper validation of untrusted remote content
Risk Level: Medium

Vulnerable Code

python
def parse_boss_info(html):
    m = re.search(r'window\.d4WorldBoss=({[^}]+})', html)
    if not m:
        return None
    
    data = json.loads(m.group(1))
    status = data.get("status", "")
    name = data.get("name", "")
    countdown_sec = data.get("time", 0)
    next_time = data.get("tsn", 0)
python
lines.append(f"【当前BOSS】{info['name']}")
lines.append(f"【状态】{info['status']}")

Technical Analysis

The script parses JSON embedded in content downloaded from an external website. The remotely controlled name value and any unrecognized status value are inserted into output without character validation, length restrictions, control-character removal, or escaping.

Known status values are mapped to fixed descriptions, but an unknown value is returned unchanged through:

python
status_desc = status_map.get(status, status)

The output is intended to be consumed within an AI Agent workflow. If the upstream endpoint or a destination reached through curl -L is compromised, an attacker could supply prompt-like text or terminal control characters in these fields. This content would then be presented as trusted Skill output. The script does not directly evaluate or execute the remote data, so this issue does not independently provide operating-system code execution.

Attack Path

  1. An attacker compromises map.caimogu.cc, influences its response, or controls a destination in its redirect chain.
  2. The attacker returns a syntactically valid window.d4WorldBoss object containing crafted text in name or an unknown status.
  3. json.loads() accepts the object, and the script extracts the attacker-controlled value without enforcing an allowlist or output-safe format.
  4. The output() function inserts the value directly i ...[truncated 816 chars]
Remediation
View remediation

Remediation Suggestions

  1. Enforce a strict allowlist for status and replace unknown values with a fixed safe label rather than returning the remote value.
  2. Validate name against the expected character set and impose a conservative maximum length.
  3. Remove control characters, terminal escape sequences, and line breaks from all remotely sourced display fields.
  4. Convert and range-check numeric fields before performing countdown arithmetic.
  5. Explicitly mark fetched values as untrusted data when passing output into an Agent workflow.
  6. Avoid unrestricted redirect handling. After retrieval, verify that the final URL uses HTTPS and that its hostname is exactly map.caimogu.cc.
  7. Check the curl return code and HTTP failure status before parsing the response.
  8. Add tests containing prompt-like strings, newlines, escape sequences, oversized values, unknown statuses, and malformed numeric fields.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs execution of a shell command (python3 scripts/fetch_boss.py) but does not declare any tool scope or permissions boundary. This creates an implicit capability expansion where an agent may run local code without clear authorization constraints, increasing the risk of unintended command execution or abuse if the script or skill directory is modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger description includes broad natural-language phrases like asking about '暗黑4世界boss', which can cause the skill to activate in loosely related conversations. Overbroad activation increases the chance of unintended execution of its shell-backed behavior and follow-on actions such as reminder setup without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes creating cron-based reminders, which are persistent system modifications, but does not warn the user or require explicit informed consent about installing scheduled tasks. Persistent jobs can outlive the session, surprise users, and be abused to generate repeated actions or notifications on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file’s docstring, status text, prompts, and user-facing output are all hard-coded in Chinese, and there is no indication that the user can select a language or that the skill is intentionally limited to a Chinese-speaking context. This matches the policy category for language or locale constraints imposed without user opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_boss.py (reported line 10)May include surrounding context.

python
def fetch_data():
    try:
        r = subprocess.run(["curl", "-s", "-L", URL], capture_output=True, text=True, timeout=30)
        return r.stdout
    except:
        return None

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Using an external subprocess (curl) to fetch web content gives the skill unnecessary process-execution capability beyond its stated purpose of reading a webpage. In constrained agent environments, this increases attack surface because PATH resolution, binary substitution, policy bypass, or future code changes could turn a simple fetch into arbitrary command execution behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s user-facing description, triggers, output examples, and reminder messages are all written exclusively in Chinese, and there is no indication that the skill supports user language preference or that Chinese is a documented opt-in requirement. This creates a natural-language policy concern because the skill appears to impose a specific language/locale by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

All user-facing instructions and outputs are presented in Chinese, with no indication that the skill is Chinese-only or that users may choose another language. This can violate language/locale policy when a skill forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.