ClawHub
Back to skill

Security audit

Tencent IMA Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about automating IMA search, but it opens a powerful local debugging interface and rewrites private knowledge-base requests with weak containment.

Install only if you trust this skill to control your IMA session and access private knowledge-base results. Before using private mode, understand that it sends a configured knowledge ID through modified IMA requests and prints extracted page text back to the agent. Prefer a pinned dependency in a virtual environment, close IMA after use, and avoid sensitive private knowledge bases until the CDP exposure and confirmation model are tightened.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ima.py:68
Finding

Privileged CDP Endpoint Allows Connections from Unrestricted Origins

Content
View full analysis

Vulnerability Details

File Location: scripts/ima.py, lines 68-69
Vulnerability Type: Exposed privileged debugging interface
Risk Level: High

Vulnerable Code

python
subprocess.Popen([APP_PATH, f"--remote-debugging-port={CDP_PORT}", "--remote-allow-origins=*"], 
                 stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

Technical Analysis

The Skill launches IMA.copilot with the Chrome DevTools Protocol enabled on port 8315 and explicitly configures --remote-allow-origins=*.

CDP is a privileged browser-control interface. A connected client can navigate pages, execute JavaScript, inspect the DOM, monitor or modify network requests, and access data available to the application session. The wildcard origin option removes origin-based WebSocket restrictions that would otherwise limit connections to the debugging service.

Although the configured host is loopback, the endpoint has no application-level authentication. Other local processes—and potentially malicious web content capable of reaching the local service—may attempt to discover debugging targets through the CDP HTTP endpoints and connect to their WebSocket debugger URLs while the Skill is running.

Attack Path

  1. A user invokes the Skill.
  2. The Skill starts IMA.copilot with remote debugging enabled on port 8315.
  3. The wildcard origin option permits WebSocket connections regardless of their declared origin.
  4. An attacker-controlled local process, or web content able to access the loopback service, queries a CDP discovery endpoint such as /json or /json/version.
  5. The attacker retrieves a target's webSocketDebuggerUrl.
  6. The attacker connects to that URL and submits privileged CDP commands.
  7. Those commands can inspect or manipulate IMA pages, network activity, and data rendered in the authenticated application session.

Impact Assessment

Successful exploitation can provide control over the IMA bro ...[truncated 596 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --remote-allow-origins=* and retain the browser's restrictive origin checks.
  2. Use a randomly selected ephemeral loopback port instead of the fixed port 8315.
  3. Ensure the debugging endpoint binds exclusively to the loopback interface.
  4. Launch automation in a dedicated temporary browser profile that does not share unrelated authentication or browsing data.
  5. Track the exact process started by the Skill and terminate it immediately after the operation completes.
  6. Reject connections to an already-open port unless the process and debugging target can be positively verified as the expected IMA instance.
  7. Minimize the lifetime of the CDP connection and disable network interception as soon as it is no longer required.
  8. Where supported, use an authenticated or pipe-based automation transport rather than an unauthenticated TCP debugging endpoint.

T08 · Insecure Dependencies

Warning
Location
README.md:30
Finding

Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 30 and 110
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip3 install websocket-client

Technical Analysis

The installation instructions direct users to install websocket-client without specifying a reviewed version or verifying an artifact hash. Consequently, the effective dependency can change over time without any modification to the audited Skill.

Package installation and later import occur with the permissions of the invoking user. If the package source, maintainer account, distribution channel, or a future release is compromised, malicious code could execute during installation or when this statement is reached in scripts/ima.py:

python
import websocket

The project does not provide a lock file, hash-verified requirements file, or isolated-environment instructions that would make the installed dependency reproducible.

Attack Path

  1. A user follows the README installation instructions.
  2. pip3 resolves the current available release from its configured package index rather than a version reviewed with this Skill.
  3. A compromised or malicious package release is downloaded and installed.
  4. Malicious package code executes during installation or when scripts/ima.py imports the package.
  5. The code runs with the permissions of the user operating the Skill.

This path requires compromise or malicious modification of the dependency or its distribution channel; no evidence in the audited project shows that the current package is malicious.

Impact Assessment

A compromised dependency could execute arbitrary code with the invoking user's privileges. Depending on that user's access, this could permit theft or modification of local files, credentials, application data, and private IMA content. It could also modify network behavior or establish persistence indepe ...[truncated 30 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin websocket-client to a specific reviewed version.
  2. Place the dependency in a requirements file with cryptographic hashes, for example using pip's --require-hashes mode.
  3. Generate and commit a reproducible dependency lock file.
  4. Document the trusted package index from which dependencies must be retrieved.
  5. Install dependencies in a dedicated virtual environment rather than the user's global Python environment.
  6. Regularly scan and deliberately update the pinned version after reviewing security advisories and release changes.
  7. Consider vendoring or otherwise integrity-verifying the minimal dependency needed for CDP WebSocket communication.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code intercepts matching application traffic and rewrites POST bodies to inject knowledge-base parameters, altering the app's intended network behavior. This is dangerous because it creates a covert capability to redirect queries, access different data scopes, or manipulate requests without a clear in-app authorization or user confirmation boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README gives broad, conversational trigger examples such as asking the agent to 'search' or 'check my personal knowledge base' without clearly constraining when the skill should activate or what confirmation is required. In an agent setting, ambiguous invocation language can cause unintended activation and accidental access to IMA or private knowledge-base features when the user did not explicitly intend that capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly describes intercepting /qa requests and injecting knowledge_ids to force-enable private knowledge-base mode, but it does not provide a clear privacy warning, consent model, or disclosure of the sensitivity of retrieved data. In this context, the skill is designed to access private knowledge sources programmatically, so missing warnings and guardrails materially increase the risk of unintended private data access or disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes a local Python script that can access shell, files, environment, and potentially networked application functionality, but the manifest declares no explicit tool scope or permission boundaries. This increases the risk of overbroad execution and makes it harder for users or the platform to understand and constrain what the skill may do, especially since it can interact with a desktop application and local configuration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The docstring presents the skill as ordinary search/knowledge assistance, but the implementation performs network interception, request rewriting, and DOM extraction through CDP. That mismatch is dangerous because it conceals privileged behavior from users and reviewers, undermining informed consent and making abuse harder to detect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The knowledge ID is sourced from environment/config and then silently injected into modified network requests, which can cause private knowledge resources to be queried without a clear user acknowledgment at execution time. In this skill's context, that is especially sensitive because the application is explicitly used for private knowledge retrieval.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ima.py (reported line 74)May include surrounding context.

python
if not APP_PATH:
        print("Error: App not found", file=sys.stderr)
        sys.exit(1)
    subprocess.Popen([APP_PATH, f"--remote-debugging-port={CDP_PORT}", "--remote-allow-origins=*"], 
                     stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    for _ in range(15):
        time.sleep(1)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script launches the desktop app with a Chrome DevTools remote debugging port and permissive origin setting, enabling deep inspection and control of the application's internals. If another local process can reach that port, it may issue CDP commands to inspect content, execute script, or manipulate sessions beyond the user's intended search action.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script executes JavaScript in the app context to extract deep rendered DOM text from the page, including shadow DOM content, which can expose far more information than a normal search result interface would reveal. In the context of a private knowledge retrieval app, this may capture sensitive rendered data and exfiltrate it to stdout or downstream consumers without meaningful minimization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The Chinese section states the skill ensures 'perfect UTF-8 Chinese results,' which implies a language-specific output behavior. The README does not indicate that language choice is optional or user-selectable, creating a potential language/locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The English section says the skill ensures 'perfect UTF-8 Chinese characters output,' which suggests the skill may force a specific language/locale behavior. No opt-in or user language selection is described, so this may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill advertises private knowledge base search driven by a local configuration file containing a knowledge identifier, but it does not warn users that local config will be consulted or that private data may be queried. In a skill specifically designed for private knowledge retrieval, this omission makes accidental disclosure or unexpected access more likely because users may not realize a query can target sensitive local knowledge sources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code rewrites sys.stdout to UTF-8 whenever the current encoding differs, which enforces a specific output encoding policy regardless of user environment. This is a natural-language policy concern because the comment explicitly states the intent to force UTF-8, without offering a choice or documenting a required locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.