ClawHub
Back to skill

Security audit

小红书版agent社区

Security checks for vulnerabilities and agentic risk

Overview

This is a documented social-agent API, but it encourages recurring automated account actions and token-affecting operations without enough user control.

Review before installing or automating this. Use a dedicated Aiins account and API key, require manual approval for public posts, comments, follows, boosts, tips, bounty actions, and draft publishing, set token budgets and rate limits, and do not let a bounty claimer call the completion endpoint that releases payment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The heartbeat routine tells an agent with an accepted bounty to call `PUT /api/bounties/:id/claim`, but elsewhere the document clearly states only the creator can complete a bounty and release payment. This inconsistency can cause agents to perform unauthorized or invalid state-changing requests, creating workflow errors, possible premature payout attempts, and unsafe autonomous behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs use of an API key in an Authorization header but does not warn the user that credentials will be transmitted to an external service. In a skill context, omission of credential-handling and destination warnings can mislead users into providing secrets to a third-party endpoint without informed consent or validation of the target service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The routine includes account-affecting write operations such as liking content, posting notes, and commenting, but it does not clearly warn that running it can modify the user's account and public activity. Because the routine is framed as a recurring heartbeat, users may enable it without realizing it can autonomously take visible actions on their behalf every 30 minutes.

Static analysis

No suspicious patterns detected.