ClawHub
Back to skill

Security audit

sudo-gold

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tavily-backed gold market analysis helper with no evidence of hidden persistence, destructive behavior, credential harvesting, or unrelated local access.

Before installing, be aware that it uses your TAVILY_API_KEY and sends gold-related search requests to Tavily. Treat its output as informational market commentary, not financial advice, and expect Chinese-language output by default.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares it requires environment access and performs external network-backed searches via Tavily, but it does not define any explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution surface where an agent may invoke capabilities beyond what users would reasonably expect, reducing auditability and increasing the chance of unintended data access or outbound requests.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description states it uses Tavily search but does not provide a clear user-facing warning that user prompts or derived search queries will be sent to an external third-party service. This creates a privacy and transparency risk because users may disclose sensitive financial intentions or personal context without understanding that the data leaves the local agent environment.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation guidance uses very broad trigger phrases such as generic requests to analyze gold or ask whether gold is worth buying. This can cause the skill to activate in ordinary conversations without clear user consent, increasing the likelihood of unnecessary third-party searches and unintended transmission of user queries to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
}

async function searchTavily(q, n = 3) {
  const resp = await fetch("https://api.tavily.com/search", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
Confidence
84% confidence
Finding
The hardcoded external endpoint indicates dependency on a remote service outside the operator's control. In this skill context, that is not inherently malicious, but it is a genuine security/privacy concern because all search activity is routed externally and availability/integrity depend on the third party.

External Transmission

Medium
Category
Data Exfiltration
Content
}

async function searchTavily(q, n = 3) {
  const resp = await fetch("https://api.tavily.com/search", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
Confidence
84% confidence
Finding
The hardcoded external endpoint indicates dependency on a remote service outside the operator's control. In this skill context, that is not inherently malicious, but it is a genuine security/privacy concern because all search activity is routed externally and availability/integrity depend on the third party.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest describes a Tavily-based skill for retrieving gold-related行情数据 from specific markets and channels. In contrast, the script builds an '黄金投资综合分析报告', queries for technical indicators and macro fundamentals, and prints investment-oriented risk guidance, which goes beyond simple market information retrieval.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The script hardcodes the zh-CN locale in its date formatting and presents all user-facing output in Chinese, which imposes a specific language/locale without any opt-in or alternative. This is a natural-language policy issue because the user is not given a choice of language or locale.

Natural-Language Policy Violations

Low
Confidence
76% confidence
Finding
Natural-language content throughout the file is in Chinese, including the recommended user utterances, and there is no indication that other languages are supported or that Chinese is required for a justified regional reason. This may constitute a language/locale policy issue because the skill appears to enforce a single language without explicit opt-in.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
This markdown file presents all guidance exclusively in Chinese, and there is no natural-language indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a violation.

Intent-Code Divergence

Low
Confidence
72% confidence
Finding
The header comment says only 'Gold Analysis Script / 黄金投资分析工具', which suggests a general analysis utility. The implementation is more specific and opinionated: it performs technical and fundamental investment analysis and outputs risk/disclaimer language, creating a documentation-to-code intent mismatch.

Static analysis

No suspicious patterns detected.