ClawHub
Back to skill

Security audit

小安智能健身

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for booking a fitness appointment, but it sends personal contact details and limited health-risk information to an external booking system without a clear user-facing privacy notice or retention terms.

Install only if you are comfortable with this merchant skill creating real booking records through its remote MCP service. Before using it with customers, add or require a clear privacy notice explaining that the booking writes name, full phone number, fitness goal, appointment details, and limited health-risk status to Feishu, who can access it, and how records can be corrected or deleted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill explicitly instructs use of a remote MCP service and fallback to a Node-based client that reads authentication material from environment variables or a local auth file, which gives it effective network and secret-access capability despite no declared permissions. This creates a trust and review gap: a host may expose network or env access without users realizing the skill can contact external services and consume sensitive tokens.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The contract explicitly requires collecting and writing personal data to Feishu, including full phone numbers and health-risk fields, but provides no user-facing privacy notice, consent language, retention limits, or handling constraints beyond 'merchant visible'. This creates a real privacy and compliance risk because users may disclose sensitive information without being clearly informed where it will be stored, who can access it, and for what purpose.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.potential_exfiltration

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
scripts/mcp-client.js:39