ClawHub
Back to skill

Security audit

sudu-gold

Security checks for vulnerabilities and agentic risk

Overview

This Chinese gold-analysis skill uses a disclosed Tavily API key to fetch market search results, with no hidden persistence, destructive behavior, or credential misuse found.

Install only if you are comfortable using a Chinese-language gold analysis helper that sends search terms to Tavily using your TAVILY_API_KEY. Do not include secrets, account details, or private trading plans in queries, and treat its investment output as informational rather than financial advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares capabilities that require environment access and network use, but it does not explicitly scope or disclose tool permissions. This creates a transparency and least-privilege problem: an agent or user may invoke the skill without realizing it can send data externally using an API key-backed network call.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The description text is presented in Chinese and the file does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-language audience. This can violate a language or locale policy when a specific language is effectively forced without user opt-in.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description explains how to fetch gold data via Tavily but does not clearly warn that user queries will be transmitted to an external search API and that use depends on a TAVILY_API_KEY. This weakens informed consent and can expose sensitive financial-interest queries or prompt content to a third party without adequate notice.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation examples use broad natural-language phrases like asking whether gold is worth buying, which could cause the skill to trigger unintentionally during ordinary conversation. Unintended activation can lead to unnecessary external API requests, disclosure of user queries to a third party, and actions being taken without clear user intent.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The code calls a generic web search API rather than a dedicated gold-price source as described in the manifest. That is risky because it expands the data surface, can return untrusted or misleading content, and misrepresents what external service receives user requests.

External Transmission

Medium
Category
Data Exfiltration
Content
}

async function searchTavily(q, n = 3) {
  const resp = await fetch("https://api.tavily.com/search", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
Confidence
84% confidence
Finding
This duplicate finding points to the same external Tavily transmission path. While not inherently malicious, the undisclosed third-party dependency and mismatch with the advertised skill purpose make the outbound network behavior more security-relevant than a clearly disclosed, tightly scoped integration would be.

External Transmission

Medium
Category
Data Exfiltration
Content
}

async function searchTavily(q, n = 3) {
  const resp = await fetch("https://api.tavily.com/search", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
Confidence
84% confidence
Finding
This duplicate finding points to the same external Tavily transmission path. While not inherently malicious, the undisclosed third-party dependency and mismatch with the advertised skill purpose make the outbound network behavior more security-relevant than a clearly disclosed, tightly scoped integration would be.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
User-provided queries are sent to an external service without any user-facing disclosure, consent prompt, or privacy notice. In this skill context, search terms may contain investment interests or sensitive business intent, so silent transmission to a third party creates a meaningful privacy and transparency risk.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill metadata claims focused gold price market data retrieval, but this code performs broader investment analysis and automatically issues multiple generic Tavily web searches. This scope mismatch is dangerous because users and hosting platforms may grant trust, permissions, or deployment approval based on the narrower stated purpose while the implementation gathers and presents broader external content.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The script forces `toLocaleString('zh-CN')` and the surrounding user-facing output is exclusively in Chinese, which imposes a specific language/locale without opt-in. The file does not indicate that this is a region-specific tool or provide any mechanism for the user to select another language or locale.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script forwards arbitrary user-supplied input as a Tavily search query, which is broader than the advertised gold-price lookup purpose. This creates a capability expansion issue: the skill can be repurposed as a generic external search proxy, increasing privacy, policy, and trust risks beyond the declared scope.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
This markdown file presents all user-facing instructional content exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no choice or justification is provided.

Static analysis

No suspicious patterns detected.