ClawHub
Back to skill

Security audit

Skillhub Cn Daily

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed daily SkillHub recommendation tool that reads limited local memory-derived keywords, calls SkillHub, and optionally publishes the generated briefing to configured destinations.

Install only if you want an automated daily recommendation workflow that can read TRAE memory keywords and publish reports. Review the configured memory path and service credentials, use --skip-push for local-only runs, and make sure the skillhub and lark-cli binaries on PATH are trusted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""执行 skillhub CLI 命令"""
    cmd = [SKILLHUB_BIN] + args
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout.strip(), result.returncode
    except Exception as e:
        return "", 1
Confidence
88% confidence
Finding
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

Tainted flow: 'SKILLHUB_BIN' from os.environ.get (line 16, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
def fetch_evaluation(slug):
    """调用 skillhub skill evaluation 获取 AI 质量评估"""
    try:
        result = subprocess.run(
            [SKILLHUB_BIN, "skill", "evaluation", slug, "--json"],
            capture_output=True, text=True, timeout=30
        )
Confidence
97% confidence
Finding
result = subprocess.run( [SKILLHUB_BIN, "skill", "evaluation", slug, "--json"], capture_output=True, text=True, timeout=30 )

Tainted flow: 'SKILLHUB_BIN' from os.environ.get (line 16, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
def fetch_reports(slug):
    """调用 skillhub skill reports 获取双实验室安全审计"""
    try:
        result = subprocess.run(
            [SKILLHUB_BIN, "skill", "reports", slug, "--json"],
            capture_output=True, text=True, timeout=30
        )
Confidence
97% confidence
Finding
result = subprocess.run( [SKILLHUB_BIN, "skill", "reports", slug, "--json"], capture_output=True, text=True, timeout=30 )

Tainted flow: 'cmd' from os.environ.get (line 41, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"""执行 skillhub CLI 命令"""
    cmd = [SKILLHUB_BIN] + args
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout.strip(), result.returncode
    except Exception as e:
        return "", 1
Confidence
97% confidence
Finding
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill declares significant capabilities in prose—environment variable access, local file read/write, network use, and shell/CLI execution—but the platform-level permission declaration is missing. This weakens user consent and enforcement because a reviewer or runtime may not have an explicit machine-readable permission boundary for sensitive operations like reading local memory and sending data to external services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented behavior minimizes data exposure by saying memory is used only for keyword extraction and that recommendations do not include raw memory, but the described workflow also exports full generated briefings to external services and may include third-party content excerpts from fetched results. This mismatch is dangerous because users may consent under a narrower privacy model than the skill actually implements, leading to unintended external transmission and retention of content.

Vague Triggers

Medium
Confidence
77% confidence
Finding
A broad trigger such as asking '有什么新 Skill' can overlap with ordinary conversation and cause the skill to activate unexpectedly. When a skill has network, file, env, and external publication behavior, accidental activation increases the chance of unintended data processing or outbound requests without clear user intent.

Unvalidated Output Injection

High
Category
Output Handling
Content
try:
        # 使用 lark-cli 创建文档
        cmd = ["lark-cli", "doc", "create", "--title", title, "--content-stdin"]
        result = subprocess.run(
            cmd,
            input=content,
            capture_output=True,
Confidence
79% confidence
Finding
subprocess.run( cmd, input=content, capture_output

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.