ClawHub
Back to skill

Security audit

Pro Summarizer (Pay-Per-Use)

Security checks for vulnerabilities and agentic risk

Overview

This paid summarizer discloses billing, but it automatically charges through an external service before summarizing and has unclear pricing and consent boundaries.

Review this before installing. It should only be used if you intentionally want a paid skill that can charge through skillpay.me on each invocation. Confirm the real price, charge amount, refund/reversal process, and who controls SKILLPAY_API_KEY and SKILLPAY_SKILL_ID. The publisher should add an explicit consent step and clean up the unrelated MJ/image-prompt capability text.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tainted flow: 'HEADERS' from os.getenv (line 9, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The code sends an API credential from an environment variable in the X-API-Key header to an external billing service, along with user-linked billing metadata. While transmitting a secret to its intended upstream service is sometimes necessary, in this skill it introduces external monetization behavior unrelated to the declared summarization function and creates a real exfiltration/privacy surface if the endpoint, configuration, or package is untrusted.

Content

Scanner excerpt · src/billing.py (reported line 13)May include surrounding context.

python
def check_and_charge(user_id: str) -> dict:
    # 每次调用扣除 0.001 USDT
    resp = requests.post(
        f'{BILLING_API_URL}/api/v1/billing/charge', 
        headers=HEADERS, 
        json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The manifest presents the skill as a summarization assistant, but the behavior includes billing, charging, remote API interaction, and likely use of environment-backed credentials. This mismatch is dangerous because users and reviewers may grant trust or invoke the skill for harmless text processing while hidden financial and external side effects occur.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The integration with an external payment API is not justified by the advertised summarization capability, making it an unexpected external dependency with financial and privacy implications. In the context of a text-summary skill, this hidden billing path materially increases risk because users and operators would not expect payment processing code to run.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A summarization skill should not silently perform account charging as part of normal execution unless that behavior is prominently disclosed and expected. This mismatch between declared capability and implemented behavior is dangerous because it can cause unauthorized charges and indicates hidden side effects beyond the user’s reasonable expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill indicates code capabilities involving environment access and network use but declares no tool scope or permission boundaries. In a skill that also references billing and charging, this lack of explicit scoping increases the risk of undeclared external actions, secret access, or unauthorized requests beyond the user-facing summarization purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instructions require identifying the user and charging them before performing the advertised task. Tying core functionality to an automatic charge without explicit, informed user approval creates a risk of unauthorized billing and privacy misuse, especially when the manifest does not prominently disclose this behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is described in the manifest as a summarization assistant, but the '核心能力' section claims capabilities like adding MJ parameters and generating creative variants, which are characteristic of image-prompt tooling rather than text summarization. This is an active documentation-to-intent contradiction, not merely missing detail, because the listed capabilities describe a different task domain than the skill's declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions mandate a Chinese summary and a fixed Chinese/English output mix, but do not offer the user any language or locale choice. This is a natural-language policy concern because it enforces a specific language behavior without documented opt-in or justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This function performs an external network transmission to a billing service during skill execution. In a summarization skill, such outbound transmission is more dangerous because it is unexpected, may expose identifiers and billing metadata, and expands the trust boundary to an external payment provider.

Content

Scanner excerpt · src/billing.py (reported line 13)May include surrounding context.

python
def check_and_charge(user_id: str) -> dict:
    # 每次调用扣除 0.001 USDT
    resp = requests.post(
        f'{BILLING_API_URL}/api/v1/billing/charge', 
        headers=HEADERS, 
        json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code transmits user_id and skill_id to a third-party billing endpoint without any visible notice, consent mechanism, or data handling disclosure. Even if the data seems limited, it links a user to a paid action and an external service, creating privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file contains natural-language guidance only in Chinese, which can violate language policy when no user language choice or justification is provided. This may make the skill's operational notes inaccessible to users or maintainers who do not read Chinese.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The code accesses SKILLPAY_API_KEY from the environment, which is a sensitive credential source covered by the warning requirement for code files. Aside from an internal Chinese comment about placeholders, there is no user-facing disclosure or warning that the skill depends on and uses a billing API key.

Content

No source excerpt is available for this finding.