ClawHub
Back to skill

Security audit

Social Media Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local CSV-based social media monitoring tool with disclosed local file writes, but users should review its dependency source and naming mismatch before installing.

Install only if you are comfortable with a Chinese-language, local-file monitoring tool that stores keywords, alert settings, and reports inside its skill directory. Prefer installing with the committed lockfile, consider regenerating it from the official npm registry, and review dependency updates before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package-lock.json:20
Finding

Dependencies Are Locked to a Third-Party npm Registry Mirror

Content
View full analysis

Vulnerability Details

File Location: package-lock.json:20-32
Vulnerability Type: Third-party dependency supply-chain exposure
Risk Level: Medium

The committed lockfile resolves packages through registry.npmmirror.com rather than the official npm registry:

json
"node_modules/@hono/node-server": {
  "version": "1.19.11",
  "resolved": "https://registry.npmmirror.com/@hono/node-server/-/node-server-1.19.11.tgz",
  "integrity": "sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==",
  "license": "MIT",
  "engines": {
    "node": ">=18.14.1"
  },
  "peerDependencies": {
    "hono": "^4"
  }
},
"node_modules/@modelcontextprotocol/sdk": {
  "version": "1.27.1",
  "resolved": "https://registry.npmmirror.com/@modelcontextprotocol/sdk/-/sdk-1.27.1.tgz",

The same third-party registry is used throughout the lockfile for direct and transitive dependencies. The installation instructions in README.md:9-15 and SKILL.md:82-88 direct users to run npm install, which processes these URLs.

Technical Analysis

A package lock normally provides deterministic versions and cryptographic integrity hashes. The included SHA-512 integrity values substantially limit the ability of a compromised mirror to silently substitute package contents. Nevertheless, using a third-party mirror introduces an additional supply-chain trust boundary and exposes installation availability and package provenance to that operator.

Malicious package substitution would generally also require modification or bypass of the lockfile integrity metadata; compromise of the mirror alone should cause an integrity failure rather than silent execution. Risk remains if an attacker can alter both the mirror content and lockfile, influence installation so integrity checking is bypassed, or exploit weaknesses in mirror synchronization and package provenance.

Attack Path

  1. A user follow ...[truncated 1326 chars]
Remediation
View remediation

Remediation Suggestions

  1. Configure npm to use the official registry:
    bash
    npm config set registry https://registry.npmjs.org/
  2. Remove and regenerate the lockfile using the trusted registry:
    bash
    rm -rf node_modules package-lock.json
npm install
  3. Verify that all resulting resolved fields use https://registry.npmjs.org/.
  4. Commit the regenerated lockfile and use npm ci in automated and production installations to enforce exact locked versions and integrity hashes.
  5. Pin security-sensitive direct dependencies to reviewed versions rather than broad compatible ranges where operationally practical.
  6. Add dependency review and vulnerability scanning to the release process, including inspection for unexpected lifecycle scripts.
  7. If the mirror is intentionally required, document the trust decision, restrict it through organizational controls, and independently verify package hashes and provenance against the official npm registry.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High
Category
Supply Chain
Confidence
86% confidence
Finding

fast-uri 3.1.0 is associated with multiple URI parsing issues including host confusion and malformed IPv6 handling, which can enable SSRF or security policy bypass when the application trusts parsed URLs for outbound requests or allowlists. For a social-media monitoring skill, URL ingestion from external content is plausible, making this dependency more concerning if any fetched links, webhooks, or remote resources are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.8 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
90% confidence
Finding

hono 4.12.8 has many listed advisories spanning cookie handling, routing, and related framework behaviors. Because @modelcontextprotocol/sdk depends on Hono and this skill likely operates as a networked service, framework-level flaws can materially affect request handling, auth boundaries, and response security even if the application code itself appears simple.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High
Category
Supply Chain
Confidence
80% confidence
Finding

ip-address 10.1.0 is flagged for address parsing inconsistencies and an XSS issue in HTML-emitting methods. This is most dangerous when IP parsing is used for trust decisions such as allowlists/rate limiting, or when generated HTML from the library is rendered; here it is transitive through express-rate-limit, so the practical risk depends on whether those specific features are exercised.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High
Category
Supply Chain
Confidence
87% confidence
Finding

path-to-regexp 8.3.0 is reported vulnerable to ReDoS/DoS via crafted route patterns or matching behavior. In a web-facing skill using Express or similar routing, this can allow attackers to consume CPU with pathological requests if vulnerable matching paths are reachable.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file metadata and comments identify the server as a different tool ('linguistic-landscape-analyzer') than the declared social-media monitor skill. This mismatch undermines transparency and trust, making it harder for users and reviewers to understand what code is actually running, which can conceal risky behavior or cause unsafe consent decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The title and core description are written in Chinese, and the README continues entirely in Chinese without indicating that the skill is China-specific or offering an alternative language. This can violate a language/locale policy when users are not given an opt-in or choice of language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The natural-language values "AI 工具" and "科技" indicate this file is constrained to Chinese terms, but there is no accompanying indication that the user chose this language or that the locale restriction is intentionally region-specific. Under the policy, forcing a specific language or locale without opt-in or clear justification is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The server header and tool descriptions are written to position the skill as a Chinese-language MCP server, and several tools return only Chinese-language status/error text. The file does not provide a general user opt-in or language-selection mechanism for these natural-language interactions, which can violate language/locale choice policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The weekly report tool writes a Markdown file to disk automatically without explicit user warning or confirmation. Silent file creation is risky in agent environments because it introduces persistent side effects, may overwrite expectations about tool behavior, and can be abused to fill storage or leave sensitive analysis artifacts behind.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill performs persistent local state mutations by writing keyword and configuration JSON files, which goes beyond purely read-only monitoring/analysis behavior suggested by the skill description. In an agent setting, undeclared disk writes can surprise users, create lasting side effects, and be chained with repeated tool calls to manipulate future outputs or operational behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The add_keyword tool persists user-supplied data into a JSON file without warning or consent. This creates durable state that affects later monitoring results, enabling accidental or malicious poisoning of the monitoring set and causing cross-session behavior changes that the user may not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The threshold-setting tool writes configuration changes to disk silently, altering future alerting behavior across sessions. Persistent configuration mutation without confirmation can disable or desensitize alerts, causing users to miss negative-sentiment signals or trust manipulated monitoring outcomes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest description is written entirely in Chinese, and the rest of the skill documentation likewise assumes Chinese without offering an opt-in or alternative locale. This can violate the language/locale policy criterion because the skill appears to force a specific language for user-facing instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The parameter documentation sets language defaults to zh for analysis functions, but the README does not clearly present this as a user-selectable locale preference or justify it as a region-specific tool constraint. This may be interpreted as forcing a locale-specific default without explicit user opt-in.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The lockfile pins @hono/node-server 1.19.11, and the listed advisories affect static file serving behavior through path normalization and slash-handling edge cases. In an MCP/server-style skill, this becomes relevant if the package exposes HTTP endpoints or serves local assets, because middleware bypass or Windows path traversal could weaken access controls or disclose files.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low
Category
Supply Chain
Confidence
82% confidence
Finding

body-parser 2.2.2 is flagged for a denial-of-service issue involving invalid limit handling. This is a real dependency risk, but in this lockfile-only context it is likely only exploitable if the skill exposes HTTP request parsing paths that accept attacker-controlled bodies.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low
Category
Supply Chain
Confidence
83% confidence
Finding

qs 6.15.0 is associated with denial-of-service and parser edge-case issues affecting query string handling. This is a genuine dependency concern, but the observed impact is generally limited to availability degradation when the service parses attacker-controlled query strings or serializes malformed inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The package description is written entirely in Chinese, which indicates the skill is intended for a specific language audience, but this file provides no user opt-in, language choice, or documented justification for the locale restriction. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Using a caret range for @modelcontextprotocol/sdk allows automatic installation of newer compatible versions, which can unexpectedly introduce vulnerable or malicious code through the software supply chain. In an MCP skill, this dependency is security-relevant because it may affect server behavior and tool exposure, so uncontrolled upgrades increase risk.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
"author": "小爪 🦞",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret range for keyword-extractor permits silent dependency drift across installs, which creates a supply-chain attack surface if an upstream release is compromised or contains a security defect. Although this library is not obviously high privilege from this file alone, unpinned third-party code still weakens build reproducibility and trust.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret range for sentiment allows unreviewed upstream changes to be pulled in during installation, increasing exposure to supply-chain compromise or regressions. In a text-processing skill, that could alter analysis logic or introduce vulnerable transitive code without explicit operator approval.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

Using a caret range for zod allows future package versions to be installed automatically, which can introduce security bugs or malicious changes into validation logic. Since validation libraries often sit on trust boundaries, supply-chain drift here is more concerning than a purely cosmetic dependency.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"
  }
}