ClawHub
Back to skill

Security audit

澍脉投放驾驶舱

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only connector for the Shumai advertising dashboard, though users should understand it sends their Shumai API key to Shumai's service.

Install only if you intend to connect Codex to Shumai's advertising dashboard. Treat SHUMAI_API_KEY as a secret, confirm the endpoint www.shumai.com.cn is the service you trust, and remember the skill can read and summarize advertising/account data but is not designed to change budgets or campaign settings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/shumai.sh (reported line 15)May include surrounding context.

sh
geo)      NAME=shumai_geo_report; ARGS='{}' ;;
  *) echo "用法: shumai.sh overview|alerts [high|warn|good]|geo" >&2; exit 2 ;;
esac
RESP=$(curl -sS --max-time 30 -X POST https://www.shumai.com.cn/mcp \
  -H 'content-type: application/json' \
  -H "Authorization: Bearer $SHUMAI_API_KEY" \
  -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"$NAME\",\"arguments\":$ARGS}}")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs use of shell commands and a local script but does not declare any tool scope restrictions such as allowed-tools or permissions. This creates an overbroad execution surface where an agent may invoke shell unexpectedly, increasing the risk of command execution beyond the intended read-only API access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill directs the agent to send an Authorization bearer token to an external domain via curl, which is an external data transmission of a secret. Even if this is the intended service, transmitting credentials through generic shell/HTTP instructions increases the risk of secret exposure, misuse, or sending data to an unvetted endpoint if the skill content is modified or spoofed.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

脚本不可用时直接发 HTTP(标准 MCP JSON-RPC 2.0):

bash
curl -s -X POST https://www.shumai.com.cn/mcp \
  -H "content-type: application/json" \
  -H "Authorization: Bearer $SHUMAI_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"shumai_overview","arguments":{}}}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown explicitly instructs the skill to turn returned text into a concise Chinese answer. This imposes a fixed language on all users without any opt-in or alternative, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language usage and error messages are written only in Chinese, including the primary help text and API-key setup instructions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/shumai.sh (reported line 15)May include surrounding context.

sh
geo)      NAME=shumai_geo_report; ARGS='{}' ;;
  *) echo "用法: shumai.sh overview|alerts [high|warn|good]|geo" >&2; exit 2 ;;
esac
RESP=$(curl -sS --max-time 30 -X POST https://www.shumai.com.cn/mcp \
  -H 'content-type: application/json' \
  -H "Authorization: Bearer $SHUMAI_API_KEY" \
  -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"$NAME\",\"arguments\":$ARGS}}")