ClawHub
Back to skill

Security audit

Clawhub Daily

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its daily ClawHub reporting purpose, but its automatic IMA behavior can send reports to a built-in knowledge-base ID and can fall back to running locally resolved CLI commands without a separate confirmation.

Install only if you are comfortable with scheduled network fetching and report pushes. Before enabling IMA, set your own kb_id, prefer --mode official, and avoid auto CLI fallback unless you trust the exact executable path. Use --skip-push, --skip-ima, or missing credentials for local-only operation.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/push_to_ima.py:136
Finding

Automatic IMA CLI Fallback Permits PATH-Based Tool Spoofing

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/push_to_ima.py:32
Finding

Hard-Coded IMA Knowledge-Base Identifier Can Route Reports to an Unconfirmed Destination

Content
View full analysis
config.json > FIM default config_kb_id = config.get("ima_kb_id") if config_kb_id and config_kb_id.startswith("<"): config_kb_id = None # Ignore placeholder kb_id = args.kb_id or config_kb_id or DEFAULT_FIM_KB_ID ``` ### Technical Analysis The IMA integration transmits the complete generated Markdown report to the official HTTPS API. The transport endpoint is fixed to `https://ima.qq.com`, which prevents arbitrary endpoint redirection and plaintext credential transmission. However, the destination knowledge base is not required to be selected by the user. If neither `--kb-id` nor `ima_kb_id` is supplied, the code silently uses a package-wide hard-coded identifier. The project files disclose this default but do not establish its ownership, access controls, or relationship to each installing user. A destination identifier is authorization-sensitive configuration. Defaulting to a globally fixed value creates a risk that users will send reports to a knowledge base they did not create or explicitly approve. Actual exposure depends on whether the supplied IMA credentials are authorized to add content to that identifier. ### Attack Path 1. A user configures valid `IMA_OPENAPI_CLIENTID` and `IMA_OPENAPI_APIKEY` credentials. 2. The user does not provide `--kb-id` and does not set `ima_kb_id` in the configuration. 3. The executor runs `push_to_ima.py`; this occurs by default unless IMA or all pushes are skipped. 4. The script ...[truncated 901 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (56)

Tainted flow: 'msg' from os.environ.get (line 101, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/push_to_feishu.py (reported line 106)May include surrounding context.

python
"msg_type": "interactive",
            "content": json.dumps(card)
        }
        resp = requests.post(
            "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
            headers=headers, json=msg, timeout=20
        )

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明将该技能描述为一个端到端的“每日扫描 + 多渠道推送”系统，但给出的代码块只是其中的推荐生成子步骤。它从本地 metrics 文件读取 Skill 数据，执行 6 维度推荐、7 天去重、痛点匹配、中文一句话生成、Markdown/飞书 blocks 输出，并保存到本地 JSON/Markdown。代码行为与声明中的推荐算法、降级策略、optional verified 维度、中文简报等内容大体一致；但声明强调的核心能力还包括实时抓取 ClawHub API、按凭证向飞书/IMA/Obsidian 推送、读取环境变量/config 凭证、以及可能调用 ima-skill CLI，这些在该代码块中完全不存在。因此若将“技能描述”视为对所提供代码块本身的准确表述，则存在明显夸大/不匹配：代码只覆盖本地推荐生成，不覆盖声明中的扫描与多渠道分发能力。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code matches only one narrow subset of the description: accessing the ClawHub Convex API and writing local files. Its actual purpose is a data collection script (fetch_clawhub.py) that retrieves paginated public skill records and stores them as a snapshot JSON. The declared description, however, presents a much broader end-to-end recommendation and distribution system, including ranking logic, deduplication across days and dimensions, Chinese report generation, and multiple outbound integrations (Feishu, IMA, Obsidian, local Markdown). None of those core behaviors are present in this code chunk. There is no evidence of undeclared harmful behavior, but there is a strong description-versus-behavior mismatch because the primary declared functionality is absent from the supplied code.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/CONTRIBUTING.md (reported line 1)May include surrounding context.

md
# 贡献指南（Contributing）

欢迎为 **clawhub-daily** 贡献代码、文档、痛点配置或 Bug 反馈！

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/PUBLISHING_GUIDE.md (reported line 119)May include surrounding context.

将 GH_TOKEN 保存到 .env.local（不入库）：

bash
echo "GH_TOKEN=ghp_xxxxxxxxxxxxx" > .env.local

确保 .gitignore 包含 .env.local（默认已包含）。

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/prompt-templates.md (reported line 80)May include surrounding context.

trending/quality/newcomers/panorama）\n3. 痛点匹配 + 10 天去重\n4. 生成简报 + 飞书推送\n\n# 输出\n简报 Markdown + 飞书卡片（200-400 字）" }, "delivery": { "mode": "announce", "channel": "feishu" } }

text

---

## 🎯 模板 3：纯 Linux/Mac crontab

**频率**：每 2 天 1 次（北京时间 21:00）  
**特点**：完全独立，无 Agent 依赖

```cron
# 编辑 crontab
0 13 */2 * * /bin/bash -c 'cd <your_clawhub_daily_path> && python clawhub_daily_executor.py >> logs/cron.log 2>&1'

<your_clawhub_daily_path> 替换为实际路径（如 ~/projects/clawhub-daily）。

建议：

  • 创建 logs/ 目录用于 cron 日志
  • 用 >> 追加而非 > 覆盖
  • 加 2>&1 重定向错误输出

🎯 模板 4：Windows Task Scheduler

频率：每 2 天 1 次（北京时间 21:00）

步骤：

  1. 打开"任务计划程序" → "创建基本任务"
  2. 名称：ClawHub Daily
  3. 触发器：每天 → 高级设置 → 勾选"重�

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Broad trigger phrases like generic daily-report prompts can cause accidental invocation in normal conversation or scheduling contexts. Because this skill performs network access and may push content to external services or local vaults, unintended activation increases the chance of unreviewed data collection and data egress.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown explicitly states '简报中文化：中文一句话 + 英文原文' and elsewhere reiterates that the output language is primarily Chinese. This is a natural-language locale policy constraint presented as a default behavior, but the file does not offer users a language selection or opt-in mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The limitations section states '语言：中文为主' with English only folded as secondary content. Because this file is user-facing documentation, specifying a fixed primary language without presenting a choice can violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clawhub_daily_executor.py (reported line 33)May include surrounding context.

python
print(f"{'='*60}")
    start = time.time()
    try:
        result = subprocess.run(
            cmd,
            cwd=cwd or str(PROJECT_ROOT),
            capture_output=False,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/PUBLISHING_GUIDE.md (reported line 74)May include surrounding context.

1. 创建仓库

bash
curl -X POST https://api.github.com/user/repos \
  -H "Authorization: token <GH_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"name": "clawhub-daily", "private": false, "auto_init": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/PUBLISHING_GUIDE.md (reported line 74)May include surrounding context.

1. 创建仓库

bash
curl -X POST https://api.github.com/user/repos \
  -H "Authorization: token <GH_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"name": "clawhub-daily", "private": false, "auto_init": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/PUBLISHING_GUIDE.md (reported line 86)May include surrounding context.

1. 创建仓库

bash
curl -X POST https://api.github.com/user/repos \
  -H "Authorization: token <GH_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"name": "clawhub-daily", "private": false, "auto_init": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/PUBLISHING_GUIDE.md (reported line 102)May include surrounding context.

1. 创建仓库

bash
curl -X POST https://api.github.com/user/repos \
  -H "Authorization: token <GH_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"name": "clawhub-daily", "private": false, "auto_init": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/PUBLISHING_GUIDE.md (reported line 86)May include surrounding context.

md
upload_file() {
  local file_path="$1"
  local content=$(base64 -w 0 "$file_path" 2>/dev/null || base64 "$file_path")
  curl -X PUT "https://api.github.com/repos/EdwardWason/clawhub-daily/contents/$file_path" \
    -H "Authorization: token <GH_TOKEN>" \
    -H "Content-Type: application/json" \
    -d "{\"message\": \"Upload $file_path\", \"content\": \"$content\", \"branch\": \"main\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-contract.md (reported line 87)May include surrounding context.

md
cursor = None

    for i in range(0, num_target, page_size):
        resp = requests.post(
            "https://wry-manatee-359.convex.cloud/api/query",
            json={
                "path": "skills:listPublicPageV4",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown template is entirely written to generate Chinese-language briefings and message cards, including headings, body copy, and UI text. The file does not offer an alternative locale or note that Chinese is optional, which can violate a language/locale policy when the skill is expected to adapt to user preferences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown explicitly defines a dedicated '中文支持 (Chinese Support)' scenario and its action templates instruct use in existing Chinese workflows, but it does not state that language selection is optional or user-driven. Under the policy, forcing or presuming a specific language/locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Multiple task templates instruct '10 天去重' while the manifest consistently declares '7 天跨维度去重' as a core behavior. This is an active contradiction in user-facing operational guidance that can cause the skill to be invoked with behavior outside its documented intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Hermes example repeats '10 天去重', which directly conflicts with the manifest's stated 7-day deduplication behavior. Because this is an execution template, it materially changes the intended operation users will trigger.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains natural-language instructions exclusively in Chinese, including all setup, warnings, and usage guidance. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a reportable issue unless the locale limitation is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file uses Chinese-only natural-language strings in the module docstring, function docstrings, argparse descriptions, and console output. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file states that it generates a Chinese one-line interpretation, and multiple functions later hard-code Chinese recommendation text and report content. Because the script does not offer a language choice or opt-in, it imposes a specific language/locale on all users, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_clawhub.py (reported line 47)May include surrounding context.

python
for attempt in range(max_retries):
        try:
            resp = requests.post(
                CONVEX_URL,
                json=payload,
                headers=DEFAULT_HEADERS,

Static analysis

No suspicious patterns detected.