ClawHub
Back to skill

Security audit

guoguo

Security checks for vulnerabilities and agentic risk

Overview

This courier-ordering skill has a legitimate purpose, but it can collect personal shipping details, create real orders, and attempt persistent MCP setup without enough user confirmation or reviewable setup code.

Review before installing. Use it only if you trust the publisher and can verify the Guoguo MCP service and setup behavior. Require explicit approval before any MCP configuration change, and confirm the account, sender, receiver, addresses, pickup time, and data transmission before submitting an order.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger words include very broad terms such as “下单” and “创建订单”, which can cause the skill to activate in unrelated ordering contexts. In a skill that collects personal data and may configure MCP tooling, accidental invocation increases the chance of unintended data collection or system changes.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill instructs the agent to collect and transmit sensitive personal information including phone numbers, names, and full sender/receiver addresses, but it does not require any explicit privacy notice, consent prompt, or minimization guidance before sending data to the external service. Because this is a shipping workflow involving third-party transmission, the context makes the omission more serious rather than less.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill requires automatically running a local shell script to modify MCP configuration whenever the needed tool is absent, but it does not require prior user approval or clearly warn that local system configuration will be changed. Executing a script from the skill base directory is a sensitive action that can alter the agent environment and, if the script is tampered with or misunderstood, could lead to broader local compromise or unauthorized persistent changes.

Static analysis

No suspicious patterns detected.