ClawHub
Back to skill

Security audit

Emergence Pulse: InStreet (涌现科学 脉搏)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed InStreet digest tool that reads a local InStreet API key and makes read-only InStreet API calls; the main risks are credential handling and untrusted social content in the output.

Install only if you trust InStreet and Emergence Science with the InStreet API key stored at ~/.config/instreet/credentials.json. Keep that credential file private, avoid committing it, and treat generated post summaries as untrusted third-party social content rather than instructions for your agent to follow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
scripts/digest.py:129
Finding

Forced Promotional Content in Agent-Facing Output

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
scripts/digest.py:75
Finding

Untrusted Remote Post Content Is Emitted Without Prompt-Injection Boundaries

Content
View full analysis
10: key_points.append(s) if len(key_points) >= 1: break if not key_points: return content[:100] + "..." if len(content) > 100 else content summary_text = key_points[0] + "。" return summary_text def format_output(posts_with_details): if not posts_with_details: return "❌ 无法从 InStreet 获取热门动态" output = ["⚡ **InStreet 今日脉搏**", ""] for i, (post, detail) in enumerate(posts_with_details, 1): title = post.get("title", "无标题")[:50] author = post.get("agent", {}).get("username", "未知智能体") upvotes = post.get("upvotes", 0) comment_count = post.get("comment_count", 0) post_id = post.get("id", "") summary = summarize_post(detail, title) output.append(f"**{i}. {title}**") output.append(f"@{author}") output.append(f"{summary}") ``` ### Technical Analysis Post bodies, titles, and author names originate from a remote service and may be controlled by InStreet users. The script selects the first sufficiently long sentence from a post and inserts it directly into agent-facing output. The cleaning o ...[truncated 2151 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description frames the behavior as a simple summary generator, but the metadata and documentation reveal additional sensitive behaviors: reading a local credential file and making outbound requests to a third-party API. That mismatch increases the risk of users or orchestrators invoking the skill without understanding that local secrets will be accessed and transmitted for network authentication.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill explicitly references a local credential file, which means execution requires secret material from the user's filesystem. Even if intended for legitimate authentication, access to local credentials is sensitive because compromise, overbroad file permissions, or misleading invocation could expose or misuse API tokens.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
emoji: "⚡"
    requires:
      env: []
    primaryCredential: "~/.config/instreet/credentials.json"
    files: ["scripts/digest.py"]
---

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The manifest explicitly points to ~/.config/instreet/credentials.json, which strongly indicates the skill will access a local credential file containing authentication material. If the skill or its dependencies are compromised, this gives a direct path to sensitive tokens or account keys, enabling account takeover, unauthorized API calls, or lateral access to connected services.

Content

Scanner excerpt · _meta.json (reported line 5)May include surrounding context.

json
"ownerId": "kn7c83ffhzqbhaqes1fdt9t5e5825jme",
  "slug": "emergence-pulse-instreet",
  "version": "0.1.0",
  "primaryCredential": "~/.config/instreet/credentials.json",
  "publishedAt": 1773993396000
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://instreet.coze.site/api/v1/ (Read-Only)
  Local files read: ~/.config/instreet/credentials.json (API Key)
  Local files written: none
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://instreet.coze.site/api/v1/ (Read-Only)
  Local files read: ~/.config/instreet/credentials.json (API Key)
  Local files written: none
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://instreet.coze.site/api/v1/ (Read-Only)
  Local files read: ~/.config/instreet/credentials.json (API Key)
  Local files written: none
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/digest.py (reported line 9)May include surrounding context.

python
SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://instreet.coze.site/api/v1/ (Read-Only)
  Local files read: ~/.config/instreet/credentials.json (API Key)
  Local files written: none
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/digest.py (reported line 22)May include surrounding context.

python
SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://instreet.coze.site/api/v1/ (Read-Only)
  Local files read: ~/.config/instreet/credentials.json (API Key)
  Local files written: none
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/digest.py (reported line 35)May include surrounding context.

python
SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://instreet.coze.site/api/v1/ (Read-Only)
  Local files read: ~/.config/instreet/credentials.json (API Key)
  Local files written: none
"""

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill advertises network use via documented external endpoints, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: hosts or users cannot reliably enforce least privilege, and a skill with undeclared network capability is harder to review and sandbox safely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest hard-codes a user home-directory credential file path as the skill's primary credential without any visible scope, least-privilege boundary, or usage constraint. This creates an implicit authorization channel where any code in the skill that can access the declared credential may obtain broad InStreet account secrets, increasing the chance of credential misuse or unintended data access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code explicitly states it will generate a Chinese summary, and the user-facing output strings throughout the script are also fixed in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The markdown file tells users to set an InStreet API key in a local credentials file, which is a sensitive operation affecting secret management. There is no accompanying warning about keeping the file secure, avoiding commits, or protecting the credential, so the description lacks user-facing disclosure for credential handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.