ClawHub
Back to skill

Security audit

爽文体验馆

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed text-game launcher that may install named child game skills, with some implementation quality issues but no evidence of hidden, destructive, or data-stealing behavior.

Before installing, understand that this hub can prompt you to add other game skills, and those child skills are separate trust decisions. Expect possible missing functionality because the main description mentions four games while the included launcher files mostly cover two. Avoid entering sensitive personal information into game saves.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 这里使用 openclaw CLI 安装
    cmd = f"openclaw skills install {skill_name}"
    try:
        subprocess.run(cmd, shell=True, check=True)
        return True
    except subprocess.CalledProcessError:
        return False
Confidence
96% confidence
Finding
The code constructs a shell command as a string and executes it with shell=True, which creates an unnecessary command-injection surface if skill_name is ever influenced by untrusted input or later modified from constants to user-controlled values. In a launcher skill, invoking external package installation also expands trust boundaries and can execute unintended commands or install untrusted content.

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill appears to use shell/subprocess capability despite not declaring any permissions, which creates an execution surface hidden from users and policy controls. In this context, undocumented shell access is risky because the skill also claims to inspect/install other skills, meaning it could execute local commands with effects beyond simple story routing.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior materially diverges from the analyzed implementation: it reportedly installs other skills, checks local filesystem paths, and only supports part of the promised functionality. This is dangerous because users may consent to a harmless game launcher but actually grant a skill that performs local system actions and dependency changes, undermining informed consent and increasing the chance of abuse.

Description-Behavior Mismatch

Medium
Confidence
79% confidence
Finding
The launcher contains code to install external skills even though the stated purpose is just a world-selection interface. Hidden or undocumented installation behavior is security-relevant because it causes side effects, pulls in external content, and can surprise users or bypass expected review flows.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
Executing shell commands to install external skills is more powerful than necessary for a simple launcher and introduces a significant attack surface. If the installer target, environment, or PATH is manipulated, the skill can trigger unintended command execution or install untrusted dependencies under the guise of normal navigation.

Static analysis

No suspicious patterns detected.