Security audit

hubstudio

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed HubStudio API/automation toolkit, but it exposes powerful device, browser, account, cookie, and destructive testing actions without enough scoping or safety gates.

Install only if you intentionally want a privileged HubStudio administration and automation helper. Do not run `testAll` on a real account or production workspace, avoid exporting secrets/cookies through it, keep `HUBSTUDIO_BASE_URL` pinned to the trusted local service, and review every generated command before allowing an agent to call it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: playwright_hubstudio_baidu_demo.js:8
Finding: OS Command Injection via Environment-Controlled Container Code
Content: View full analysis
/tmp/hubstudio-injection-proof; #' ``` 3. The user runs: ```bash node playwright_hubstudio_baidu_demo.js ``` 4. `runHubstudio()` constructs a command equivalent to: ```bash node hubstudio.js browserStart x; id > /tmp/hubstudio-injection-proof; # ``` 5. The shell executes the injected command with the privileges of the user running the demonstration. ### Impact Assessment Successful exploitation provides arbitrary command execution unde ...[truncated 426 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: hubstudio.js:8
Finding: Unrestricted HubStudio Base URL Allows Sensitive Request Redirection
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: hubstudio.js:189
Finding: Smoke-Test Command Invokes Destructive and Privileged API Operations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: hubstudio.js:204
Finding: Diagnostic Report Stores Unredacted Requests and API Responses
Content: View full analysis
Remediation: View remediation
({ command, method, path, status, code, msg, success, })), }; ``` If detailed diagnostics are explicitly enabled: - Recursively redact keys such as `password`, `accountPassword`, `otpSecret`, `cookie`, `Authorization`, `token`, `proxyPassword`, `adbPassword`, and equivalent case variations. - Avoid storing request bodies for credential, account, cookie, proxy, and ADB endpoints. - Create the report with owner-only permissions: ```javascript fs.writeFileSync(reportPath, serializedReport, { encoding: "utf8", mode: 0o600, flag: "w", }); ``` - Store diagnostics outside the source tree in a dedicated private state directory. - Add report paths to `.gitignore` and CI artifact-exclusion rules. - Define a short retention period and securely delete reports after troubleshooting. - Clearly warn users before generating any report that may contain sensitive data. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (69)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill exposes an endpoint explicitly described as executing shell commands on cloud mobiles. Remote command execution is highly sensitive and, in a skill advertised for endpoint lookup and parameter explanation, creates a severe risk of arbitrary command execution, data exfiltration, persistence, or device compromise if an agent is induced to call it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The exposed /api/v1/cloud-mobile/exe-command endpoint allows arbitrary shell command execution on cloud phones, which is a direct remote code execution capability. In the context of a skill marketed for endpoint lookup and schema validation, this is especially dangerous because it hides a highly privileged action behind a benign-seeming interface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documented endpoint allows remote shell command execution on cloud phones, including multi-command execution separated by semicolons. In the context of an OpenAPI reference skill, this is highly dangerous because it creates a path to arbitrary code execution, device tampering, data destruction, or persistence far beyond passive documentation use.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file materially expands the skill from OpenAPI lookup/validation into operational remote device control by documenting how to enable ADB, connect to cloud phones, authenticate, and run shell-level commands. In the context of a reference/documentation skill, this is dangerous because it equips the agent or user to perform privileged actions on devices that are outside the declared scope, increasing the chance of unauthorized administration or abuse.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented commands include device-administration actions such as package listing, app install/uninstall, shell access, and reboot. For a skill presented as an OpenAPI reference tool, these capabilities are unjustified and create a path to alter device state, disrupt service, or tamper with software on managed cloud phones.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file is materially out of scope for a skill described as an OpenAPI lookup/validation helper: it provides operational instructions for launching browser environments, driving Playwright/agent-browser, visiting external sites, scraping content, and writing results to local files. That expands the skill from passive API reference into active execution and data collection, increasing the chance of misuse, unintended network access, and exfiltration of browsed content under the cover of a benign OpenAPI skill.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The README instructs users to run rm -rf on a path in their OpenClaw workspace before copying files. Although the target is quoted and not obviously attacker-controlled here, recursive deletion is still dangerous because users may paste commands blindly, path assumptions may be wrong, and an existing skill directory could be deleted without backup or confirmation.
Content: Scanner excerpt · README.md (reported line 181)May include surrounding context.
适合“先固定版本再使用”。

bash
rm -rf "$HOME/.openclaw/workspace/skills/hubstudio" cp -R "./" "$HOME/.openclaw/workspace/skills/hubstudio"

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a passive OpenAPI reference/validation skill, but the content instructs direct execution of live HubStudio operations such as starting, stopping, foregrounding, and testing environments. This mismatch is dangerous because users or agents may trust the skill as read-only documentation while it actually enables state-changing actions on local infrastructure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a passive OpenAPI reference/validation skill, but the content instructs direct execution of live HubStudio operations such as starting, stopping, foregrounding, and testing environments. This mismatch is dangerous because users or agents may trust the skill as read-only documentation while it actually enables state-changing actions on local infrastructure.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
This project includes `hubstudio.js`, so you can execute capabilities directly:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
This project includes `hubstudio.js`, so you can execute capabilities directly:

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is ներկայացված as an OpenAPI lookup/validation aid, but the generated command surface exposes broad state-changing operations including create, delete, start/stop, proxy updates, cookie import/export, account management, and device control. This mismatch is dangerous because agents or users may invoke powerful mutating endpoints under the assumption that the skill is read-only or documentation-focused, increasing the chance of unauthorized changes, destructive actions, or secret handling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill includes file-upload functionality to cloud mobiles, including upload from a public URL and local upload. In the context of a lookup/validation skill, this can be abused to place untrusted files on managed devices, potentially delivering malware, staging sensitive files, or altering device state without users realizing the skill has write capabilities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Cookie import/export endpoints enable direct handling of browser session material, which can allow session hijacking, account takeover, impersonation, or unauthorized persistence across environments. This is especially dangerous because the skill’s stated purpose does not justify secret/session transfer operations, so users may not expect that invoking it can expose or modify live authentication state.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is described as an OpenAPI lookup/validation tool, but the implementation is an active API client that can create, start, stop, foreground, and arrange browser environments. This capability mismatch is dangerous because users or higher-level agents may invoke it under the assumption that it is read-only documentation assistance, while it actually performs state-changing operations against a local or configured HubStudio service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is presented as a lookup/validation helper for OpenAPI documentation, but the spec exposes a broad operational control surface including creation, deletion, execution, browser control, account management, and device mutation. This creates a dangerous capability mismatch: an agent or user invoking a supposedly informational skill could unknowingly gain powerful state-changing actions well beyond the declared purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The browser endpoints expose local-environment control and automation-enabling artifacts such as debugging ports, webdriver paths, window control, and start/stop operations. In a lookup skill, these capabilities can enable unauthorized browser automation, inspection, or manipulation of local sessions and are not justified by the declared documentation use case.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The account-list/export functionality exposes sensitive credentials and secrets including account passwords and OTP secrets. This materially exceeds the documented purpose of API lookup/validation and could enable account takeover or downstream compromise if an agent or unauthorized user can access the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code constructs a shell command and executes it with execSync, then connects Playwright over CDP to a browser instance, giving the skill command-execution and full browser-driving capability unrelated to its advertised OpenAPI role. In this context, those capabilities are dangerous because they enable arbitrary process invocation and remote web interaction primitives that could be repurposed beyond documentation lookup.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script performs live browser automation against an external search engine, clicks arbitrary search results, reads page content, and writes a local report, which is materially outside the declared OpenAPI lookup and schema-validation purpose of the skill. This broadens the skill from passive API reference assistance into active web interaction and data collection, increasing the chance of unintended navigation, exposure to untrusted content, and misuse as a general browsing/exfiltration primitive.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented as a documentation/lookup and parameter-validation reference, but the content exposes many operational and state-changing endpoints. This scope mismatch is dangerous because an agent or user may trust the skill as read-only reference material while it actually enables destructive or security-sensitive actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: File-upload functionality is unrelated to a read-only API reference skill and can be abused to deliver untrusted payloads or manipulate device state. Combined with mobile management features, it materially increases the ability to stage files for later execution or configuration tampering.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These endpoints expose account credentials, passwords, and 2FA secrets and also permit updating or adding them. Bundling secret-management functionality into a general reference skill increases the chance of credential disclosure, misuse, or silent exfiltration by agents or downstream automations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill includes local/browser-environment control features such as opening environments, obtaining debugging ports, foregrounding windows, stopping all environments, and clearing browser data. In a skill described as lookup/reference only, these capabilities materially expand attack surface and could enable automation abuse, session hijacking, or operational disruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The clear-cache endpoint allows wiping local data across all environments when identifiers are omitted, but this broad destructive default is not strongly highlighted. In automation contexts, an omitted field or malformed call could cause large-scale unintended data loss.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command, suspicious.env_credential_access (+1 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: playwright_hubstudio_baidu_demo.js:11

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:181

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: hubstudio.js:8

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: commands.generated.json:2