ClawHub
Back to skill

Security audit

调用自定义摘要 API，对用户提供的文本进行处理并返回结果

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple text-summary proxy that openly forwards user-provided text to a named external API, so it is coherent but should only be used with non-sensitive content.

Install only if you trust the operator of the external API and the environment running the server. Do not submit confidential, regulated, personal, credential-bearing, or proprietary text unless you are comfortable with it being sent to the listed endpoint and potentially appearing in server logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documentation describes network access to an external API and likely operational capabilities beyond a purely declarative skill, but it does not declare permissions or otherwise make those capabilities explicit. This creates a transparency and governance gap: reviewers and users cannot easily assess what external access the skill needs, which weakens consent, auditing, and policy enforcement.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs sending user-provided text to a third-party HTTPS endpoint, but it does not explicitly warn users that their content will leave the local/trusted environment or describe the privacy implications. If users submit sensitive prompts, personal data, credentials, or proprietary text, that data could be exposed to an external service without informed consent.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dev": "node --watch server.js"
  },
  "dependencies": {
    "express": "^4.18.2"
  }
}
Confidence
89% confidence
Finding
The dependency uses a caret range (^4.18.2), which allows installation of different patch/minor versions over time and can reduce build reproducibility. In a security context, non-deterministic dependency resolution can unexpectedly introduce vulnerable or incompatible versions, though the risk here is limited because the range stays within Express 4.x.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low
Category
Supply Chain
Confidence
95% confidence
Finding
The manifest references Express 4.18.2, which is associated with published advisories including XSS via response.redirect() and an open redirect issue in malformed URLs. Even though package.json alone does not prove the vulnerable APIs are used, shipping a known vulnerable framework version increases attack surface and becomes dangerous if the server code performs redirects with user-influenced input.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
server.js:52