ClawHub
Back to skill

Security audit

Android Sharesdk Integration

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a ShareSDK integration guide, but it asks agents to handle app secrets, modify Android build files, and run dependency downloads using mutable or poorly scoped dependency sources.

Review carefully before installing. Use a pinned, verified MobSDK plugin version, prefer documented vendor repositories, avoid the alternate legacy Maven repository unless you can verify it, and do not put real app secrets in files that may be committed or echoed in chat. Run Gradle only after separate confirmation and preferably in a clean branch or restricted build environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:189
Finding

Unpinned Gradle Build Plugin Allows Unreviewed Upstream Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:183-189, with automatic dependency retrieval at SKILL.md:257-267
Vulnerability Type: Dynamic build dependency version
Risk Level: High

Vulnerable Code

groovy
// File 2: Project-level build.gradle

// Add to buildscript.dependencies
classpath "com.mob.sdk:MobSDK2:+"

The Skill subsequently instructs the Agent to execute:

bash
cd {project_path}
./gradlew --refresh-dependencies

Technical Analysis

The + version selector instructs Gradle to resolve the latest available version of the MobSDK2 build plugin rather than a specific reviewed release. Gradle plugins execute code during project configuration and compilation, so they operate as executable dependencies rather than passive libraries.

Because the selected artifact can change after the Skill has been reviewed, future executions may retrieve different plugin code without any change to this repository. The explicit use of --refresh-dependencies increases exposure by forcing Gradle to recheck remote repositories instead of consistently relying on previously cached artifacts.

Exploitation requires control of, or a compromise affecting, the upstream repository, publication account, dependency metadata, or artifact-resolution process. No evidence shows that the currently referenced package is malicious; the vulnerability is the unsafe mutable dependency policy.

Attack Path

  1. An attacker compromises the plugin publisher, remote repository, release process, or relevant artifact metadata.
  2. The attacker publishes a malicious version matching com.mob.sdk:MobSDK2:+.
  3. The user authorizes the Skill to add the dynamic dependency to the Android project.
  4. The Skill runs ./gradlew --refresh-dependencies.
  5. Gradle resolves and downloads the attacker-controlled release.
  6. The malicious plugin executes during Gradle configuration or build execution with the privileges ...[truncated 702 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the dynamic selector with an explicitly reviewed version:
    groovy
    classpath "com.mob.sdk:MobSDK2:<audited-exact-version>"
  2. Verify the selected version against the vendor's official release documentation before use.
  3. Enable Gradle dependency verification and commit trusted SHA-256 checksums in gradle/verification-metadata.xml.
  4. Use dependency locking where applicable and review all lockfile or verification-metadata changes.
  5. Avoid --refresh-dependencies by default. Explain the network and code-execution implications and request separate explicit confirmation before running Gradle.
  6. Run builds in a restricted environment with minimum credentials and filesystem access, particularly in CI.
  7. Configure repository content filters so only expected MobTech group identifiers can be resolved from the vendor repository.

T08 · Insecure Dependencies

Error
Location
SKILL.md:542
Finding

Legacy Integration Retrieves an Executable Plugin from an Unverified Alternate Maven Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:542-553
Vulnerability Type: Unsafe third-party dependency repository combined with dynamic version resolution
Risk Level: High

Vulnerable Code

groovy
// Gradle plugin versions below 7.0

// Project-level build.gradle configuration
allprojects {
    repositories {
        maven { url "https://mvn.zztfly.com/android" }
    }
}
buildscript {
    repositories {
        maven { url "https://mvn.zztfly.com/android" }
    }
    dependencies {
        classpath "com.mob.sdk:MobSDK2:+"
    }
}

Technical Analysis

The legacy integration directs Gradle to resolve dependencies and an executable build plugin through https://mvn.zztfly.com/android. Elsewhere, the Skill uses the vendor-domain repository https://mvn.mob.com/android, but it provides no provenance, integrity policy, or explanation establishing the alternate domain as an authorized mirror.

Adding the alternate repository to both allprojects.repositories and buildscript.repositories broadens the exposure. The former may affect application dependencies, while the latter can supply code that executes inside Gradle. The risk is compounded by MobSDK2:+, which permits an arbitrary future matching version to be selected.

HTTPS protects transport only when the endpoint and certificate trust chain remain secure. It does not protect against repository compromise, malicious publication by an authorized repository operator, dependency substitution, or an upstream account takeover. The project does not prescribe checksums, signatures, dependency verification, or content filters.

Attack Path

  1. An attacker gains control over the alternate repository, its publishing credentials, DNS or hosting infrastructure, or an artifact source trusted by the repository.
  2. The attacker publishes or substitutes an artifact under the expected com.mob.sdk:MobSDK2 coordinates.
  3. The user ...[truncated 990 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the alternate repository unless its ownership and authorization by MobTech can be independently verified.
  2. Prefer the official vendor-controlled repository over an unexplained mirror.
  3. If legacy compatibility requires a mirror, document its provenance and restrict it to the exact expected group:
    groovy
    exclusiveContent {
    forRepository {
        maven { url "https://verified.example/repository" }
    }
    filter {
        includeGroup "com.mob.sdk"
    }
}
  4. Pin MobSDK2 to a reviewed exact version instead of using +.
  5. Enable Gradle dependency verification with trusted artifact checksums or signatures.
  6. Apply repository content filters and prevent unrelated application dependencies from resolving through the repository.
  7. Require explicit user confirmation before initiating dependency downloads or running the Gradle wrapper.
  8. Execute legacy builds in an isolated, least-privilege environment without unnecessary production credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description emphasizes an interactive Android ShareSDK integration assistant with a 6-step workflow and user confirmation at each step. The supplied code does not implement any interactive guide, trigger handling, conversational logic, or Android project integration behavior. Instead, it uses openpyxl to create a formatted Excel template listing ShareSDK-related configuration fields and instructions, then saves that file locally. While the generated content is related to ShareSDK configuration, the primary behavior is materially different from the declared purpose. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation example "帮我集成ShareSDK到Android项目" is broad enough that it could match many general integration requests without clearly constraining when this skill should activate versus when other Android integration skills should. The README lists examples, but it does not provide exclusion conditions or boundaries for closely related cases.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The phrase "帮我配置微信分享" could refer to many unrelated WeChat sharing implementations, not specifically ShareSDK integration for Android. Without explicit constraints or exclusions, this increases the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template explicitly asks users to enter highly sensitive credentials such as appSecret values for MobSDK and multiple social platforms, but it provides no guidance on safe handling, storage, or redaction. In an interactive skill context, users may paste secrets directly into the chat or into files that are later committed to source control, creating a realistic path to credential leakage and downstream account compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill content, prompts, and trigger examples are presented exclusively in Chinese and direct the interaction in that language. There is no opt-in or statement that the skill is limited to Chinese-speaking users or China-region projects, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger phrases are broad enough to match generic requests about adding sharing features, which may invoke this skill even when the user did not ask for MobTech ShareSDK specifically. In context, that is risky because the skill goes on to recommend project modifications, credential collection, and dependency changes tied to a particular vendor SDK, potentially steering users into unintended changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs users to place appKey, appSecret, and platform credentials into a local spreadsheet and then have the system read them, but it does not warn about the sensitivity of those secrets, storage hygiene, or accidental disclosure in logs and generated files. In a code-assistant context, encouraging credential handling without safeguards can lead to secret leakage through project artifacts, chat transcripts, or repository commits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill proposes modifying Gradle files and running './gradlew --refresh-dependencies', which changes the build environment and pulls remote dependencies, but it does not present an upfront warning about side effects such as dependency resolution changes, build breakage, or repository trust implications. In this context, automatic project modification combined with command execution can unexpectedly alter a user's codebase and supply chain posture.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest and boundary section describe the skill as an interactive guide for adding sharing capability and ShareSDK integration, centered on social sharing, Gradle configuration, devInfo, and privacy compliance. However, the technical reference explicitly documents third-party login flow using ShareSDK user auth APIs, which expands beyond sharing integration into authentication capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes guidance to access third-party login tokens and user IDs even though its stated purpose is share integration. That unnecessary expansion of scope can lead an agent to assist with collecting authentication artifacts without clear user intent, increasing the risk of over-privileged data handling and accidental exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md
data = [
        ["SinaWeibo.appKey", "新浪微博 App Key", ""],
        ["SinaWeibo.appSecret", "新浪微博 App Secret", ""],
        ["SinaWeibo.redirectUri", "回调地址（默认：https://api.weibo.com/oauth2/default.html）", "https://api.weibo.com/oauth2/default.html"],
        ["SinaWeibo.shareByAppClient", "是否使用客户端分享（默认true）", ""],
    ]
    return create_sheet_with_header(wb, "微博", headers, data)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/generate_excel_template.py (reported line 130)May include surrounding context.

python
data = [
        ["SinaWeibo.appKey", "新浪微博 App Key", ""],
        ["SinaWeibo.appSecret", "新浪微博 App Secret", ""],
        ["SinaWeibo.redirectUri", "回调地址（默认：https://api.weibo.com/oauth2/default.html）", "https://api.weibo.com/oauth2/default.html"],
        ["SinaWeibo.shareByAppClient", "是否使用客户端分享（默认true）", ""],
    ]
    return create_sheet_with_header(wb, "微博", headers, data)

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The boundary section says the skill should only focus on Android ShareSDK engineering integration and compliance, creating an expectation of a narrow sharing/integration scope. Earlier in the same file, the appendix adds a concrete third-party login implementation example, which contradicts that documented boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains user-facing natural-language content fixed to a specific language, beginning with the module description in Chinese and continuing throughout the script. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example prompts and section headings are entirely written in Chinese, which can constitute a language/locale policy concern when the skill does not offer any explicit user choice or opt-in for language. There is no surrounding text indicating that the skill is region-specific or that Chinese is optional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.