ClawHub
Back to skill

Security audit

小红书抖音痛点雷达 Pain-Point Radar

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious with medium confidence because it can request undeclared weekly reruns and research on additional platforms, and scanner coverage is partial.

Consider the broader platform support and recurring weekly reruns before installing. Skillspector recommends against installation; its scan was partial because several local references in the skill description could not be resolved, so the evidence is incomplete. The verdict is suspicious, which indicates review-worthy risks, not a determination that the author acted maliciously.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/radar.py (reported line 78)May include surrounding context.

python
if data is not None:
        req.add_header("Content-Type", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=timeout, context=_SSL["context"]) as resp:
            status, raw = resp.status, resp.read()
    except urllib.error.HTTPError as err:
        status, raw = err.code, err.read()

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The main workflow matches the declared research purpose, and accessing LINKDIGEST_API_KEY and contacting LinkDigest are expected implementation details. However, the code exposes an undeclared recurring-execution option and additional research platforms. The weekly option is particularly material because requesting automatic future runs differs from comparing manually repeated runs. The supplied client delegates collection, counting, quotation verification, and comparison to the remote service, so those server-side behaviors and pricing claims cannot be independently verified from this chunk.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The skill can request automatic weekly reruns, whereas the manifest describes user-initiated analyses and comparisons when a topic is run again.

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

When --weekly is supplied, the request includes "weekly": true; L200 explicitly describes this option as automatically rerunning the analysis every week. This introduces ongoing scheduled activity beyond the manifest's stated rerun-and-compare behavior, potentially causing recurring API-credit consumption rather than only the per-analysis cost described.

Content

No source excerpt is available for this finding.