ClawHub
Back to skill

Security audit

focusAI

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly discloses screen monitoring, but it tells users to run unpinned external code that can capture screens and use a cloud API key.

Review or pin the FocusAI repository before running it, and do not run it as administrator. Expect screenshots to be saved locally and sent to your configured cloud vision provider, protect the API key in config.json, and delete retained screenshots/reports when no longer needed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:313
Finding

Mutable Remote Repository Is Retrieved and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation
``` 2. **Verify artifact integrity** - Publish a SHA-256 checksum for a release archive. - Require users to verify the checksum before running any script. - Prefer cryptographically signed releases or signed Git tags and document signature verification. 3. **Avoid immediate execution after retrieval** - Separate download, verification, configuration, and execution into distinct steps. - Tell users to inspect `start.bat` and relevant application code before execution. - Display the exact expected release version and revision in the Skill documentation. 4. **Vendor reviewed components where practical** - Include the reviewed launcher and required source in the distributed Skill package. - If remote retrieval remains necessary, restrict it to immutable, integrity-verified artifacts. 5. **Constrain runtime privileges** - Run FocusAI as a standard user rather than an administrator. - Restrict filesystem access to its configuration and designated data directory. - Restrict outbound network access to the explicitly configured cloud vision provider. - Bind the local API exclusively to the loopback interface and add authentication if other local processes should not be able to control monitoring. 6. **Protect sensitive data** - Store the API key using an operating-system credential manager instead of plaintext configuration where supported. - Provide screenshot exclusion, redaction, retention, and deletion controls. - Clearly identify the configured cloud endpoint before monitoring starts and require renewed consent when that e ...[truncated 20 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

All user-facing trigger phrases, examples, prompts, and interaction guidance are specified only in Chinese, and the document does not state that the skill is region-specific or provide any opt-in language selection. This can violate language/locale policy when users are not given a choice about the language used for activation and responses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger guidance includes broad natural-language patterns such as opening focus mode or asking what the user is doing, which can plausibly match ordinary conversation and cause the skill to activate unintentionally. In this skill’s context, unintended activation is more dangerous than usual because activation can lead to screen monitoring, screenshot capture, and later cloud analysis of sensitive on-screen content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

用户想切换工作内容时，无需重启，直接 POST 新目标即可覆盖：

python
requests.post("http://127.0.0.1:8765/api/start", 
              json={"goal": "写论文 - 文献综述部分"})

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

用户想切换工作内容时，无需重启，直接 POST 新目标即可覆盖：

python
requests.post("http://127.0.0.1:8765/api/start", 
              json={"goal": "写论文 - 文献综述部分"})

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

用户想切换工作内容时，无需重启，直接 POST 新目标即可覆盖：

python
requests.post("http://127.0.0.1:8765/api/start", 
              json={"goal": "写论文 - 文献综述部分"})

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

python
def check_service():
    try:
        r = requests.get("http://127.0.0.1:8765/api/focus/score", timeout=3)
        return r.ok
    except:
        return False