ClawHub
Back to skill

Security audit

Japan Business Operations (EDITION)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Japan business API skill, but it needs Review because its remote persistent memory can store personal or business notes without clear privacy, deletion, or access-control boundaries.

Review before installing. Basic Japan information lookups are purpose-aligned, but avoid submitting confidential business plans, visa or passport details, client notes, employee information, itineraries, or contact preferences unless you are comfortable sending them to EDITION's remote service. Do not use the memory endpoints for sensitive data until the publisher documents consent, retention, deletion, isolation, and access controls; verify the npm MCP package separately before running it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly encourages storing person-related notes in a remote persistent memory service, including potentially sensitive relationship and preference data, but provides no privacy notice, retention limits, consent guidance, or data handling constraints. In an agent context, this can lead to silent collection and long-term external storage of personal data, creating privacy, compliance, and data minimization risks.

External Transmission

Medium
Category
Data Exfiltration
Content
Search all 10 knowledge domains simultaneously with a single query.

```bash
curl -X POST https://api.edition.sh/api/v1/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "opening a restaurant in Osaka"}'
Confidence
90% confidence
Finding
This example instructs the agent to send user queries to an external third-party API endpoint. External transmission is a real security concern for skills because user prompts, business plans, and operational details may be exfiltrated outside the host environment without an explicit trust boundary or consent flow.

External Transmission

Medium
Category
Data Exfiltration
Content
Search all 10 knowledge domains simultaneously with a single query.

```bash
curl -X POST https://api.edition.sh/api/v1/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "opening a restaurant in Osaka"}'
Confidence
90% confidence
Finding
This example instructs the agent to send user queries to an external third-party API endpoint. External transmission is a real security concern for skills because user prompts, business plans, and operational details may be exfiltrated outside the host environment without an explicit trust boundary or consent flow.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Regulation Check

```bash
curl -X POST https://api.edition.sh/api/v1/regulation/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"action": "open a restaurant in Tokyo", "entity_type": "foreign_company"}'
Confidence
88% confidence
Finding
This endpoint sends operational and business-formation details to an external service. In context, users may submit sensitive regulatory, corporate, or expansion plans, so the skill increases risk by normalizing remote submission without stating data handling or consent requirements.

External Transmission

Medium
Category
Data Exfiltration
Content
### 3. Business Protocol

```bash
curl -X POST https://api.edition.sh/api/v1/protocol/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "business card exchange"}'
Confidence
85% confidence
Finding
Although this protocol query looks low sensitivity in the example, the skill design routes user content to an external service and may be used with private business-context questions. The vulnerability is the undisclosed external transmission channel, not the specific example text.

External Transmission

Medium
Category
Data Exfiltration
Content
### 4. Foreign Market Entry

```bash
curl -X POST https://api.edition.sh/api/v1/foreign-entry/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "how to get a management visa"}'
Confidence
89% confidence
Finding
Foreign-entry and visa questions often contain personal, immigration, or company-formation data, making external transmission more sensitive in this context. The skill presents the remote API as a normal workflow without describing privacy boundaries, increasing the chance of unintentional disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
### 5. Calendar Intelligence

```bash
curl -X POST https://api.edition.sh/api/v1/calendar/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "best time to start a business in Japan"}'
Confidence
82% confidence
Finding
Calendar intelligence queries are still sent to a third-party server and may reveal strategic timing, business launch plans, or internal scheduling considerations. The issue is moderate because the context is less inherently sensitive than memory or immigration, but the transmission is still undisclosed in security/privacy terms.

External Transmission

Medium
Category
Data Exfiltration
Content
### 6. Travel & Entertainment

```bash
curl -X POST https://api.edition.sh/api/v1/travel/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "ryokan etiquette"}'
Confidence
78% confidence
Finding
Travel and etiquette searches also involve remote data transmission, but the sample content is generally lower sensitivity than other domains. This is still a true issue because the skill does not distinguish harmless from sensitive inputs and provides no user-facing warning about external processing.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Store
curl -X POST https://api.edition.sh/api/v1/memory/episodes \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"content": "Met with Tanaka-bucho. He prefers informal meetings.", "auto_extract": true}'
Confidence
97% confidence
Finding
This memory-store example sends personal notes about an identified individual to a remote service for persistent storage, making the external transmission particularly risky. In context, this combines data exfiltration risk with persistence, profiling, and potential privacy-law exposure, especially because no consent, retention, or deletion guidance is provided.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"content": "Met with Tanaka-bucho. He prefers informal meetings.", "auto_extract": true}'

# Recall
curl -X POST https://api.edition.sh/api/v1/memory/episodes/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "what does Tanaka prefer"}'
Confidence
93% confidence
Finding
The recall endpoint transmits search queries about previously stored person-related information to the same external service, reinforcing the privacy risk around remote profiling and retrieval of personal data. In combination with the storage example, this creates a clear pattern of third-party handling of potentially sensitive memory content.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:52