ClawHub
Back to skill

Security audit

竞品分析神器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a normal competitor-report tool, but its documented offline mode is not enforced and business inputs plus the API key can be sent to a configurable remote endpoint.

Review before installing. Do not use this with confidential product strategy unless you are comfortable sending it to the configured LLM endpoint. Avoid custom OPENAI_BASE values unless you trust that provider with both your prompt data and API key. Be aware that CA_FREE_MODE=true does not actually prevent API calls when OPENAI_API_KEY is set in this version.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
competitor_analyzer.py:178
Finding

Documented Offline Mode Is Ignored, Causing Unintended Transmission of Business Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
competitor_analyzer.py:195
Finding

Unrestricted API Base URL Can Receive the API Credential and Sensitive Prompt Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Tainted flow: 'OPENAI_BASE' from os.environ.get (line 31, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

The code lets OPENAI_BASE come directly from an environment variable and then sends the Authorization bearer token plus user-supplied business data to that URL. If OPENAI_BASE is changed to an attacker-controlled endpoint, the tool will exfiltrate the API key and sensitive product/competitor information, creating an SSRF-style credential/data leakage risk.

Content

Scanner excerpt · competitor_analyzer.py (reported line 208)May include surrounding context.

python
log(f"  调用 {OPENAI_MODEL} 分析 {len(competitors)} 个竞品...")

    try:
        resp = requests.post(
            f"{OPENAI_BASE}/chat/completions",
            headers={
                "Authorization": f"Bearer {OPENAI_API_KEY}",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README encourages use of an external API for analysis but does not clearly warn that the user's product descriptions, competitor lists, strengths, and market information may be transmitted to a third-party service. In a business intelligence context, those inputs can contain confidential strategy, roadmap, or market positioning data, so omission of a disclosure creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The README documents a default external endpoint and configurable API base, confirming that user-supplied analysis inputs can be transmitted off-host to a remote service. In this skill's context, the data being analyzed is likely commercially sensitive, and the ability to swap to a proxy or compatible API increases the chance of sending that data to an untrusted endpoint if users are not warned and guided properly.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

md
| 变量 | 默认值 | 说明 |
|------|--------|------|
| `OPENAI_API_KEY` | - | OpenAI API Key (推荐) |
| `OPENAI_BASE` | `https://api.openai.com/v1` | API地址（可换代理/兼容API） |
| `OPENAI_MODEL` | `gpt-4o-mini` | 模型（便宜够用） |
| `CA_OUTPUT_DIR` | `./ca_output` | 输出目录 |
| `CA_FREE_MODE` | `false` | 强制模板模式（不调API） |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises capabilities consistent with reading environment variables, writing files, and making network requests, but it does not declare any explicit tool scope or permissions. That weakens user visibility and policy enforcement, increasing the chance that sensitive data or local files are accessed or transmitted without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The deep-analysis mode requires an OpenAI API key and implies sending user-provided business content to an external AI service, but the skill does not warn users that their data may leave the local environment. Because competitor analysis can include proprietary product strategy and market positioning, undisclosed third-party transmission is a meaningful confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill states that all reports are automatically archived, but it does not clearly warn users that their inputs, including product strategy, competitor lists, and analysis outputs, will be stored on disk. For a business-analysis tool, these inputs may contain confidential plans or market intelligence, so silent persistence creates a real privacy and data-retention risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · competitor_analyzer.py (reported line 31)May include surrounding context.

python
# ========== 配置 ==========

OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "")
OPENAI_BASE = os.environ.get("OPENAI_BASE", "https://api.openai.com/v1")
OPENAI_MODEL = os.environ.get("OPENAI_MODEL", "gpt-4o-mini")

OUTPUT_DIR = Path(os.environ.get("CA_OUTPUT_DIR", "./ca_output"))

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The code sends user-provided business information to an external API endpoint for report generation. External transmission is expected for an LLM-backed tool, but in this skill's context the data may include confidential strategy or market information, so the lack of strong disclosure/minimization makes it a real privacy/security concern.

Content

Scanner excerpt · competitor_analyzer.py (reported line 208)May include surrounding context.

python
log(f"  调用 {OPENAI_MODEL} 分析 {len(competitors)} 个竞品...")

    try:
        resp = requests.post(
            f"{OPENAI_BASE}/chat/completions",
            headers={
                "Authorization": f"Bearer {OPENAI_API_KEY}",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill transmits potentially sensitive product strategy, strengths, market plans, and competitor inputs to an external LLM API, but the CLI does not present an explicit consent or warning at runtime before upload. In business-analysis context, this can expose confidential commercial data to a third party without the user's informed awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Natural-language policy requires avoiding forced language or locale constraints without user opt-in. This README presents all instructions and usage guidance only in Chinese, with no alternate language option or explanation that the skill is intended exclusively for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

SQP-3 covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents the skill wholly in Chinese and does not state that it is China-specific or provide an alternate language option, which can be interpreted as an unannounced language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language interface, usage instructions, prompts, and output expectations are all hard-coded in Chinese, which effectively forces a specific language experience. There is no indication that users can opt into another language or select a locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.