ClawHub
Back to skill

Security audit

Japan Business Operations (EDITION)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent remote Japan business knowledge service, but it asks users to run unpinned external MCP code and use externally retained memory without enough safeguards.

Review before installing. Basic API queries are consistent with the skill's purpose, but avoid sending confidential business plans, personal data, regulated information, or secrets. Do not enable the MCP server unless you have reviewed or pinned the npm package, and treat the memory feature as external retained storage until the publisher documents retention, deletion, and access controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:136
Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:48
Finding

Shared Bearer Credential Is Hardcoded in Public Skill Instructions

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:118
Finding

Persistent Memory Workflow Can Transmit Personal or Confidential Context Without Safeguards

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The authentication and usage examples normalize sending business queries and later memory content to a third-party API, but there is no user-facing disclosure that prompts and operational data leave the local environment. This is risky because users may assume the skill is a local knowledge base and inadvertently transmit proprietary or sensitive information.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This example sends a user query to an external API endpoint, which is a real data egress behavior. While external API usage is expected for a hosted knowledge service, the danger is that the skill presents this without strong warning that task content may be disclosed to a third party.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Search all 10 knowledge domains simultaneously with a single query.

bash
curl -X POST https://api.edition.sh/api/v1/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "opening a restaurant in Osaka"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This example sends a user query to an external API endpoint, which is a real data egress behavior. While external API usage is expected for a hosted knowledge service, the danger is that the skill presents this without strong warning that task content may be disclosed to a third party.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Search all 10 knowledge domains simultaneously with a single query.

bash
curl -X POST https://api.edition.sh/api/v1/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "opening a restaurant in Osaka"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The regulation-check example transmits operational business intent and entity details to an external service. In context this is expected product behavior, but it still creates confidentiality risk if users submit sensitive expansion plans, legal matters, or client data without warning.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

2. Regulation Check

bash
curl -X POST https://api.edition.sh/api/v1/regulation/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"action": "open a restaurant in Tokyo", "entity_type": "foreign_company"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The protocol-check example sends a query to an external endpoint, creating ordinary network data exposure. The content shown is low sensitivity, so the primary issue is lack of transparency rather than inherently dangerous functionality.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

3. Business Protocol

bash
curl -X POST https://api.edition.sh/api/v1/protocol/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "business card exchange"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The foreign-entry example submits immigration- and market-entry-related questions to an outside API, which may reveal sensitive legal or strategic information about a person or company. The skill does not pair this with any privacy or data-sharing warning.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

4. Foreign Market Entry

bash
curl -X POST https://api.edition.sh/api/v1/foreign-entry/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "how to get a management visa"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This calendar-intelligence example causes outbound transmission of user queries to a remote service. The example itself is low sensitivity, but the skill still lacks disclosure that user inputs leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

5. Calendar Intelligence

bash
curl -X POST https://api.edition.sh/api/v1/calendar/check \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "best time to start a business in Japan"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The travel-search example transmits user queries to a third-party API. The risk is limited by the benign sample content, but it remains a real egress path that should be disclosed to users.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

6. Travel & Entertainment

bash
curl -X POST https://api.edition.sh/api/v1/travel/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "ryokan etiquette"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The persistent memory examples explicitly store personal and business context such as meeting notes and individual preferences in an external service, but the skill does not warn about retention, access scope, or privacy consequences. In an agent setting, users may upload sensitive personal data, confidential business details, or regulated information without informed consent or data minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This memory-store example sends personally attributable meeting notes and preference data to an external API, making the data exposure concrete rather than hypothetical. In a business-agent context, such memory entries can easily contain confidential relationship details, personal data, and internal intelligence, amplifying privacy and compliance risk.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

bash
# Store
curl -X POST https://api.edition.sh/api/v1/memory/episodes \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"content": "Met with Tanaka-bucho. He prefers informal meetings.", "auto_extract": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The memory-search example queries externally stored memory, confirming that prior sensitive content may be indexed and retrievable by a remote service. This increases the risk of unintended disclosure and creates an expectation of persistent off-platform storage without adequate warning.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
-d '{"content": "Met with Tanaka-bucho. He prefers informal meetings.", "auto_extract": true}'

# Recall
curl -X POST https://api.edition.sh/api/v1/memory/episodes/search \
  -H "Authorization: Bearer edition_dev_key_for_testing" \
  -H "Content-Type: application/json" \
  -d '{"query": "what does Tanaka prefer"}'

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs users to run an MCP server via npx -y edition-mcp-server without pinning a specific version or integrity hash. That causes execution of whatever package is current at install time, creating a supply-chain risk if the package is compromised, replaced, or updated with unsafe behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
## Links

- **API Docs**: https://api.edition.sh/docs
- **Landing Page**: https://edition.sh
- **GitHub**: https://github.com/hiroshic9-png/edition-api
- **npm**: https://www.npmjs.com/package/edition-mcp-server

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:52