Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because scanners report automatic network version checks and persistent storage of feedback, which go beyond its described onboarding and routing purpose; the overall confidence is medium.
Consider the reported automatic network activity and persistent feedback storage before installing. The scan was partial: 12 of 14 components were scanned, and the tool-misuse analyzer was degraded for two shell scripts, so the evidence is incomplete. The verdict is suspicious, not a finding that the author acted maliciously.
Local skill discovery directly supports routing, but automatically contacting an update service is an additional capability not disclosed in the description. This creates unexpected outbound traffic and can reveal installed skill names through request paths, although no business-material upload is shown.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# --- remote versions (parallel, 3s cap per request) -------------------------------
export BASE TMP
cut -d' ' -f1 "$TMP/local" | xargs -P 16 -I{} sh -c \
'curl -fsL --max-time 3 "$BASE/$1/SKILL.md" -o "$TMP/$1.remote" 2>/dev/null || rm -f "$TMP/$1.remote"' _ {}
# --- compare -----------------------------------------------------------------------
newer=""
Without declared permissions the skill's intent is opaque and cannot be validated.
The instructions require an update-check script on every invocation without asking permission, with network requests rate-limited by the script rather than disabled by default. A content or business-analysis request therefore causes unrelated outbound activity and local timestamp persistence.
Routine feedback is explicitly promoted into persistent, authoritative rules without waiting for a save request. This crosses the boundary between task-specific conversation and future agent instructions, allowing misunderstood or adversarial feedback to contaminate subsequent behavior.
The rule requires verbatim archival of feedback without a privacy notice, consent gate, or sensitive-data filter. In a business-analysis skill, ordinary corrections can contain customer information, financial details, or confidential operational facts that users did not intend to retain.
The script makes outbound requests whose paths contain installed skill names, using an environment-overridable destination and following redirects. There is no consent or offline-policy check in the script, so automatic invocation exposes limited installation metadata and initiates unexpected network activity; downloaded content is not executed.
The script always emits its update notification and update instructions in Chinese, regardless of the user's preferred language or locale. No language selection or justification for a Chinese-only notification is provided.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Phrases such as “这个怎么用” (“how do I use this”), “第一次用” (“first time using”), and “给我演示一下” (“give me a demonstration”) explicitly enter onboarding before mode selection and routing checks. These everyday requests can refer to unrelated tools or tasks, but this trigger block does not require that they refer to AI KEY.