ClawHub
Back to skill

Security audit

公众号黑马账号推荐

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ranking-fetch tool that uses a RedFox API key to retrieve WeChat growth data, with some credential-handling behavior users should understand first.

Install only if you intend to use RedFoxHub and are comfortable giving this skill access to a REDFOX_API_KEY. Prefer setting the key as an environment variable, review any shell profile entries containing REDFOX_API_KEY, and revoke or rotate the key if you no longer use the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The spec explicitly instructs the skill to search users' shell profile files (~/.bashrc, ~/.zshrc, ~/.bash_profile, ~/.profile) to extract an API key. Reading unrelated local configuration files is not necessary for a skill whose purpose is merely to display ranking data, and it expands access to sensitive local secrets beyond what users would reasonably expect. In an agent context, this creates a real risk of credential harvesting or accidental exposure of other tokens stored in those files.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The script scans local shell startup files such as ~/.bashrc and ~/.zshrc to recover API credentials automatically. For a ranking-fetching skill, this exceeds least-privilege expectations and expands access to unrelated local secrets stored in those files, making the behavior riskier in an agent context where users may not expect filesystem credential harvesting.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document combines two sensitive behaviors: harvesting credentials from local shell config files and sending authenticated HTTP requests to an external domain, but it provides no user-facing warning or consent flow. That lack of transparency is dangerous because users may unknowingly allow the skill to access local secrets and transmit them off-host as API authentication material. The benign stated function of fetching a ranking list does not justify hidden credential discovery behavior, which makes the context more suspicious rather than less.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The workflow explicitly instructs the agent to execute the ranking-fetch script when the user's request is vague, instead of asking a clarifying question. This weakens intent verification and can cause unintended external data access or actions based on ambiguous prompts, which is a real control-flow safety issue even though the action here is read-oriented and low risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.