Security audit

POWPOW 简化版 - 在 OpenClaw 中轻松创建和管理 POWPOW 数字人

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate POWPOW management integration, but it handles account credentials, avatar/location data, and local feedback logs.

Install only if you trust POWPOW and are comfortable using this skill as a remote POWPOW client. Use a POWPOW-specific password, review avatar file paths before upload, understand that location searches go to AMap, and delete ~/.powpow-simple logs or feedback files if you do not want them retained locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The metadata declares no permissions, yet the skill reportedly uses environment capabilities. Undeclared capabilities reduce transparency and informed consent, making it harder for users and reviewers to understand what sensitive data or execution context the skill can access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose omits materially sensitive behaviors: credential handling, avatar upload to remote services, feedback collection with metadata/logs, and local persistence of logs/JSON in the user's home directory. This mismatch can mislead users into disclosing credentials, files, location, and diagnostic data without understanding the full data flow or storage impact.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The declared skill surface exposes operational capabilities beyond the described scope, including avatar upload, feedback submission, and renewal actions. This mismatch can mislead reviewers, users, and policy enforcement layers, causing under-review of functions that handle user content, account state, or billable/resource-consuming actions.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill implements a feedback collection workflow that gathers user messages, contact information, diagnostic logs, and persists them locally, but this capability is outside the declared digital-human management scope. Hidden or under-disclosed data collection and persistence increases privacy risk because users may submit feedback without realizing operational data and prior logs are being bundled and stored.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The feedback path collects recent logs, user agent data, and environment-derived context and packages them with the user's message. This is dangerous because logs often contain usernames, file paths, tokens, or prior sensitive inputs, creating an unintended data exfiltration and privacy exposure channel unrelated to the skill's primary purpose.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill enables local filesystem writes for logs and later feedback persistence under the user's home directory, which exceeds the minimum capability needed for basic digital-human management. Local file writes can accumulate sensitive operational data and create forensic artifacts or privacy leakage on shared systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README instructs users to register, log in, upload avatars, search locations, and submit feedback, but it does not clearly disclose that credentials, contact details, images, and location queries will be sent to external services such as POWPOW and Amap. This can mislead users about where sensitive data is going and weakens informed consent, especially in an agent/skill context where users may assume actions are local.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill collects usernames and passwords but provides no warning about how credentials are transmitted, stored, or protected. In a chat-driven skill, users may paste secrets directly into the interface, increasing the risk of interception, logging, or unintended retention.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The avatar upload feature asks for a local file path but does not warn users that the selected file may be transmitted to an external service. This creates a risk of unintended disclosure of personal images or accidental upload of the wrong local file.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The location search feature uses a third-party map service but does not warn users that location-related queries may be shared externally. Location data is privacy-sensitive, and even keyword-based searches can reveal habits, home/work areas, or travel intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Feedback submission stores the user's message, contact info, logs, and user-agent data to a local file without any explicit warning at submission time. This is dangerous because users may reasonably expect a simple support message, not persistent collection of diagnostics and metadata that may include sensitive history.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The manifest describes a skill that handles credentials, uploads files, and sends user input to external services, but it does not disclose that this data leaves the local environment. This creates a consent and privacy risk because users may provide sensitive data without understanding it will be transmitted to POWPOW or third-party providers.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The registration command collects a username and password but does not warn users that these credentials will be submitted to an external POWPOW service. Credential collection is inherently sensitive, and lack of disclosure increases the risk of users entering passwords they would not otherwise share or reusing passwords without informed consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The login command solicits credentials without informing users that the data will be sent to an external service for authentication. This is dangerous because authentication data is highly sensitive, and silent transmission can undermine user trust and increase the consequences of password reuse or accidental disclosure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The avatar upload command accepts a local file path but does not disclose that the referenced file contents will be uploaded to an external service. Users may mistakenly expose personal images or unrelated local files if they do not understand the command performs external transmission.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The location search command sends user-provided keywords to a third-party map provider, but the manifest does not warn that these queries may be shared externally. Location-related queries can reveal sensitive interests, travel plans, or whereabouts, so undisclosed transmission creates a privacy risk.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The feedback command allows users to submit free-form messages and optional contact details without warning that this information may be transmitted to and stored by an external service. Free-form text can easily contain personal, confidential, or security-sensitive information, making undisclosed handling a privacy concern.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The feedback flow bundles recent logs together with user-provided details, which can inadvertently expose prior sensitive inputs, tokens, usernames, file paths, or operational errors to support handlers or anyone with local file access. In this skill's context, logging is extensive and includes account actions, making the chance of over-collection materially higher.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:567