ClawHub
Back to skill

Security audit

小红书转链工具

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu URL-conversion client, but it handles account tokens and user URLs through a remote service with weak transport and TLS controls that users should review carefully.

Install only if you are comfortable using this third-party conversion backend, sending Xiaohongshu URLs to it, and storing its login token locally. Prefer explicit user confirmation before registration, login, or submitting paid quota-consuming conversions, and avoid enabling insecure TLS or password login unless you understand the transport risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill explicitly uses network access and environment/config storage but does not declare corresponding permissions, which weakens user and platform visibility into its real capabilities. In practice, it contacts an external service, persists authentication tokens locally, and supports runtime configuration overrides, so undeclared capabilities can lead to surprise data flows and reduced security review effectiveness.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The advertised purpose is URL conversion, but the skill also performs account registration/login flows, token persistence, quota management, logout, backend reconfiguration, and optional insecure TLS behavior. This mismatch is dangerous because users or orchestrators may invoke it expecting a narrow utility while it actually handles credentials, writes long-lived auth tokens, and sends data to a third-party HTTP service.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions include broad keywords such as '小红书', '转链', and '链接转换', which can cause the skill to activate in contexts where the user did not intend account-based submission to an external service. Overbroad invocation increases the chance of accidental credential workflows, unintended data disclosure, and unnecessary calls to a paid remote backend.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
/** 忽略 HTTPS 证书校验（服务端自签/域名不匹配证书时由 insecure 配置开启）。进程级，仅提示一次。 */
function allowInsecureTls() {
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
  if (!_insecureNoted) {
    _insecureNoted = true;
    process.stderr.write('[warn] 已按配置忽略 HTTPS 证书校验（insecure=true）\n');
Confidence
98% confidence
Finding
Setting NODE_TLS_REJECT_UNAUTHORIZED='0' disables TLS certificate validation for the entire Node.js process, not just this client. That allows man-in-the-middle interception of HTTPS traffic, including API tokens, login credentials, SMS-related flows, and task data; in this skill context, the presence of auth methods makes the risk more serious because sensitive session and credential material may traverse the compromised channel.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
src/client.js:15