Tree hole, wanna listen your story and life voice. hope you could give me your story.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:24 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it can send sensitive chat history to an external Feishu form with weak scoping and consent controls.

Review before installing. Use this only for content you explicitly want submitted to the listed Feishu form, avoid sending chat history unless you manually select and redact it first, and verify the agent-browser dependency source/version before installing.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 15–19 **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Setup you need install agent-browser skill ``` ```bash clawhub install agent-browser ``` ### Technical Analysis The setup directs users to install the third-party `agent-browser` Skill by a mutable package name. It does not specify an immutable version or digest, verify the package's integrity or publisher, or require a source-code review. Consequently, the dependency installed at deployment time may differ from the dependency that was originally evaluated. Compromise of the package, its publisher account, or its distribution registry could introduce attacker-controlled behavior without requiring changes to this project. Because the dependency provides browser automation functionality, a malicious version could potentially access browser state, interact with websites, submit unauthorized data, or invoke other capabilities available in the Agent environment. ### Attack Path 1. An attacker compromises the `agent-browser` package, its publisher account, or the package distribution channel. 2. The attacker publishes a malicious release under the same mutable package name. 3. A user follows the documented setup instruction and runs `clawhub install agent-browser`. 4. The package manager retrieves and installs the attacker-controlled release. 5. When the Skill invokes browser automation, the malicious dependency executes with the permissions granted to the Agent or installed Skill. 6. The dependency may access browser data, manipulate form submissions, or perform other unauthorized actions within those permissions. ### Impact Assessment Successful exploitation could allow execution of attacker-controlled Skill behavior with the permissions available to the installed dependency. The affected scope may include browser sessions, accessible website content, user-pr ...[truncated 290 chars]
• Remediation: ## Remediation Suggestions - Pin `agent-browser` to a reviewed, immutable version or cryptographic digest. - Document the expected publisher, source repository, and integrity hash. - Verify package signatures or checksums before installation. - Review the dependency and its transitive dependencies before approving updates. - Apply an allowlist for trusted package sources and publishers. - Run the browser automation dependency with the minimum necessary permissions. - Isolate it from unrelated files, credentials, browser profiles, and Agent tools. - Establish a controlled update process that requires security review before changing the pinned release.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:23
• Finding: Overbroad Chat-History Access Without Explicit Retrieval Scope## Vulnerability Details **File Location**: `SKILL.md`, lines 23–26 **Vulnerability Type**: Insufficiently scoped access to sensitive session history **Risk Level**: Medium ### Vulnerable Code ```markdown ### 1. Determine Content Source - **Original story**: User types or pastes their own content - **Chat conversation**: Fetch with `sessions_history`, format as dialogue, anonymize PII, confirm with user ``` ### Technical Analysis The workflow instructs the Agent to retrieve chat content through `sessions_history`, but it does not require the user to identify a specific session, select a bounded message range, or authorize retrieval before the history is accessed. The stated confirmation occurs after retrieval and formatting. The anonymization guidance is also limited to real names, phone numbers, and addresses. Session history may contain other sensitive material, including email addresses, account identifiers, authentication tokens, financial information, private third-party messages, confidential business information, or metadata that enables re-identification. Although the Skill explicitly requires anonymization and user confirmation, the absence of retrieval boundaries and comprehensive redaction requirements creates a least-privilege failure. More information than necessary could be read, processed, and placed into a payload intended for an external Feishu form. ### Attack Path 1. A user asks the Agent to share a recent conversation anonymously. 2. The Agent invokes `sessions_history` without a required session identifier, message range, or other explicit scope constraint. 3. The retrieved history includes unrelated private messages, secrets, or identifying details. 4. The Agent formats the history and applies only the documented limited PII redactions. 5. Sensitive information not covered by those redaction categories remains in the submission preview. 6. If the user overlooks the retained information during confirmation, the Agent submits it t ...[truncated 755 chars]
• Remediation: ## Remediation Suggestions - Obtain explicit user consent before invoking `sessions_history`. - Require the user to select a specific session and bounded message range. - Retrieve only messages strictly necessary for the requested submission. - Display the exact proposed payload after redaction and require final approval immediately before submission. - Expand redaction to cover email addresses, account identifiers, credentials, authentication tokens, financial data, workplace details, unique metadata, and sensitive third-party content. - Use secret-detection and PII-detection checks in addition to manual anonymization instructions. - Default to excluding messages authored by or concerning third parties unless the user confirms that they may be included. - Abort submission if the payload contains unresolved secrets or if the user does not explicitly approve the final redacted text. - Clearly disclose that approved content will be transmitted to the specified external Feishu form.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs submission of stories and chat conversations to an external Feishu form without a prominent warning that sensitive data will be transmitted to a third party. Users may reasonably assume they are only interacting with the assistant, so the absence of explicit disclosure undermines informed consent and increases the chance of privacy violations.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow explicitly tells the agent to fetch session history and submit it externally, which is a concrete instruction to move private conversation data outside the system boundary. This is more dangerous in context because the skill is designed around anonymity and emotional disclosures, making the content especially likely to contain sensitive personal information.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad enough to activate on vague phrases like 'share anonymously' or similar wording, which can cause the skill to run in situations where the user did not clearly intend to send sensitive content to an external service. In this skill, that ambiguity is especially risky because the action involves transmitting potentially private stories or chat excerpts to a third-party Feishu form.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Encouraging users to submit recent chat conversations to a third-party form creates a direct natural-language data exfiltration path. Partial guidance to anonymize PII is not sufficient because conversations can still contain sensitive facts, relationship details, secrets, or contextual identifiers that are difficult to fully redact.

Static analysis

No suspicious patterns detected.