ClawHub
Back to skill

Security audit

Maoyan CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Maoyan movie and cinema lookup helper that uses a local Python script to query disclosed Maoyan endpoints and does not show persistence, credential access, or unrelated behavior.

Install only if you are comfortable with the agent running a local Python script that contacts Maoyan. Do not provide precise latitude and longitude unless you want Maoyan to use them for distance-based cinema results.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to execute a local Python script that makes external requests to Maoyan, which means it has network-capable behavior. However, the skill metadata does not declare any explicit tool scope such as permissions or allowed-tools, so the agent may invoke networked code without a clear least-privilege boundary or reviewable authorization model. In an agent environment, undeclared network access increases the risk of unintended data egress, SSRF-style misuse through script arguments, or execution in contexts where network use should be prohibited.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. The file presents all instructions and examples only in Chinese, with no indication that the skill is region-specific or that users can opt into this language, which may impose a language constraint by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The entire reference is written in Chinese and presents field descriptions, usage notes, and output semantics only in that language. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The cinemas command accepts --lat and --lng and sends them to the remote Maoyan endpoint, which constitutes transmission of potentially sensitive location data. While the help text says these values are recommended for sorting by distance, it does not clearly warn that the coordinates will be sent over the network to an external service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/maoyan_cli.py (reported line 289)May include surrounding context.

python
for day_block in m.get("shows") or []:
            show_date = day_block.get("showDate") or day_block.get("dt") or ""
            day_block["cinemaPageUrl"] = _cinema_page_url(cinema_id_out, movie_id, show_date)
            for s in day_block.get("plist") or []:
                seq_no = s.get("seqNo")
                date_for_seat = s.get("dt") or show_date
                if seq_no:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The detail command includes optional --lat and --lng values in the request URL to the external service. The code comments and argument help identify the parameters but do not explicitly warn users that their location data will be transmitted to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The movie-cinemas command forwards --lat and --lng to the remote API, which is a network transmission of sensitive location information. Although the CLI help mentions distance sorting, it does not clearly disclose the privacy implication that the coordinates are sent off-device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file is in scope for SQP-2. Multiple examples encourage passing --lat and --lng for the user's position, which is privacy-relevant location data, but the document provides no warning or disclosure about collecting, transmitting, or protecting that information.

Content

No source excerpt is available for this finding.