ClawHub
Back to skill

Security audit

guoguo

Security checks for vulnerabilities and agentic risk

Overview

The skill’s shipping-order workflow is mostly coherent, but it tells the agent to run a missing setup script that can persistently modify MCP tool configuration without clear user approval.

Review this skill before installing. It appears intended for legitimate Guoguo shipping orders, but only use it if you trust the MCP server setup path and are comfortable providing names, phone numbers, and full addresses. The setup step should be changed to require explicit approval, show the exact MCP config change, and include the missing script for review before use.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:12
Finding

Automatic Persistent Modification of MCP Tool Configuration Without Explicit User Approval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–25
Vulnerability Type: Automatic modification of the host application's MCP tool configuration
Risk Level: Medium

Relevant executable code snippet:

bash
bash <Base directory>/setup-mcp.sh

The surrounding instructions require this initialization check every time the skill is triggered. If a tool associated with guoguo_send_server is unavailable, the agent is directed to run the script. The document states that the script locates the Qoder MCP configuration and adds the server automatically.

Technical Analysis

MCP configuration controls which external tools the agent can invoke and where potentially sensitive tool arguments are sent. Automatically changing that configuration crosses the boundary between performing the stated shipping task and administering the agent's persistent tool environment.

The workflow does not require informed user approval before the change, display the target configuration file or proposed diff, identify and validate the MCP server endpoint, restrict the configuration entry to an allowlisted service, or provide a rollback procedure. Because the resulting MCP tool is subsequently given names, telephone numbers, full addresses, and order information, configuration integrity is security-sensitive.

This is best classified as tool hijacking risk because modification of the MCP registry can cause a legitimate-looking shipping tool call to reach an unintended implementation. The repository does not establish that such redirection actually occurs; the vulnerability is the unverified and unconsented configuration-change mechanism.

Attack Path

  1. A user request triggers the shipping-order skill.
  2. The agent determines that no guoguo_send_server tool is currently available.
  3. Following the mandatory setup instruction, the agent executes setup-mcp.sh.
  4. The script modifies the host application's persis ...[truncated 1081 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not modify MCP configuration automatically merely because the expected tool is unavailable.
  2. Require explicit, informed user approval before making any persistent configuration change.
  3. Before approval, display:
    • The exact configuration file to be changed.
    • The complete proposed configuration entry.
    • The MCP server endpoint and transport.
    • The expected permissions and data categories sent to the service.
  4. Validate the server against a pinned allowlist and require authenticated, encrypted transport.
  5. Verify the service identity using pinned certificates, keys, or signed configuration metadata where supported.
  6. Create a configuration backup and provide an automatic rollback operation.
  7. Apply least-privilege file permissions and reject symlinks, path traversal, and configuration files outside the intended application directory.
  8. Ask the user to review and confirm the complete shipping payload immediately before transmitting personal data.
  9. Document the service operator, privacy policy, retention policy, and data-processing scope.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:18
Finding

Security-Sensitive Setup Script Referenced but Missing From the Audited Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–25
Vulnerability Type: Missing and unverifiable configuration script
Risk Level: Low

Complete referenced command:

bash
bash <Base directory>/setup-mcp.sh

The audited project contains only SKILL.md; the referenced setup-mcp.sh file is absent.

Technical Analysis

The skill depends on a local script that is described as detecting and modifying the application's MCP configuration. Because the script is not included, its implementation, destinations, endpoint values, permission handling, path validation, backup behavior, and error handling cannot be reviewed.

In the package as audited, the command should fail because the referenced file does not exist. This is primarily an insecure packaging and implementation defect. It can become a security issue if operators attempt to repair the package by obtaining an unverified script or if another file can be placed at the expected path before execution.

There is no evidence in the audited artifact that the skill downloads a replacement script or that a malicious script is already embedded. Consequently, remote payload retrieval and embedded malicious-code classifications are not substantiated.

Attack Path

  1. The shipping skill is triggered while its MCP tool is unavailable.
  2. The agent attempts to execute the documented setup command.
  3. Execution fails because setup-mcp.sh is absent.
  4. An operator, installer, or automated recovery process may obtain or create a replacement without a package-authenticity guarantee.
  5. Alternatively, an attacker with prior write access to the skill directory could place a script at the expected path.
  6. On the next trigger, the replacement executes with the permissions of the Qoder process and can alter configuration files accessible to that process.

Impact Assessment

As delivered, the immediate confirmed impact is failure of the auto ...[truncated 561 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include setup-mcp.sh in the reviewed package or remove the automatic setup instruction.
  2. Bind the script to a signed release manifest containing its cryptographic digest.
  3. Resolve the skill base directory canonically and verify that the script is a regular file owned by the expected user.
  4. Reject symbolic links, unexpected ownership, group-writable files, and world-writable files before execution.
  5. Never download or source a replacement script dynamically.
  6. Ensure the implementation writes only to the intended MCP configuration file and uses atomic updates.
  7. Back up the original configuration and restore it automatically if validation or startup fails.
  8. Add tests covering missing files, malformed configuration, duplicate server entries, unsafe paths, and insufficient permissions.
  9. Fail closed with a clear error instead of instructing the agent or user to locate an unverified replacement.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs collection of names, phone numbers, and full addresses for both sender and receiver and transmission to an external shipping service, but provides no explicit privacy notice or consent step. This creates a meaningful data-handling risk because highly sensitive personal information may be disclosed to a third party without informed user authorization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match common language such as '下单' or '创建订单', which can cause the skill to activate in contexts unrelated to courier shipment. In this skill, accidental activation is more dangerous because it leads into collection of personal data and potentially initiates external service actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to run a local shell script that modifies MCP configuration before performing its main business function. That expands the skill's authority from order creation into local system/configuration changes, creating a dangerous trust boundary violation and an opportunity for unauthorized persistence, tool injection, or execution of unintended code from the skill's base directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setup instructions tell the agent to run a script that edits local MCP configuration, but do not warn the user before this system-level change occurs. In context, this is especially risky because configuration modification is framed as a mandatory hidden prerequisite, reducing the chance of informed consent and increasing the likelihood of silent environment tampering.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.