ClawHub
Back to skill

Security audit

极鲸云 Temu 评论搜索

Security checks across malware telemetry and agentic risk

Overview

The skill is a purpose-aligned Temu review lookup tool that uses GeekBI APIs and a disclosed local login cache, with no evidence of hidden, destructive, or unrelated behavior.

Install this only if you intend to let the skill contact GeekBI's service and store/reuse a local GeekBI login token for Temu review searches. Be aware that the auth state may be mirrored into user config, the skill directory, and the current working directory under .geekbi/agent-auth.json.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill instructs the agent to read local reference files and execute local Python scripts, which implies file_read, shell, and likely network access, but no permissions are declared. This creates a transparency and governance gap: the skill can perform sensitive actions without explicit user- or platform-visible permission scoping, increasing the risk of unintended data access or outbound requests if the referenced scripts behave unsafely.

VirusTotal

49/49 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.