ClawHub
Back to skill

Security audit

TRTC AI Customer Service

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to build the advertised TRTC customer-service app, but the generated app exposes unauthenticated cloud-control and credential-issuing endpoints that need review before use.

Install only if you intend to build a TRTC Conversational AI customer-service app. Treat the generated project as a development/demo base until you add /action authentication, rate limits, room/task ownership checks, least-privilege cloud keys, and SDK pinning or self-hosting; protect env.yaml and do not approve killing an unknown port-8080 process.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/scaffold.py:250
Finding

Unauthenticated Privileged API Permits Arbitrary TRTC Credential Issuance and Conversation Control

Content
View full analysis
dict: user_id = data.get("userid") if not user_id: raise ValueError("userid is required") sigs = signer.sign_trio(user_id) avatar_enabled = config.is_avatar_enabled() return { "sdkappid": sigs["sdkappid"], "userid": sigs["user_id"], "usersig": sigs["user_sig"], "robot_userid": sigs["robot_user_id"], "robot_usersig": sigs["robot_user_sig"], "avatar_userid": sigs["avatar_user_id"] if avatar_enabled else "", "avatar_usersig": sigs["avatar_user_sig"] if avatar_enabled else "", "avatar_available": avatar_enabled, "end_keywords": config.all_end_keywords(), "farewell_message": { "zh": config.farewell_message("zh"), "yue": config.farewell_message("yue"), "en": config.farewell_message("en"), }, "transfer_keywords": config.all_transfer_keywords(), "transfer_message": { "zh": config.transfer_message("zh"), "yue": config.transfer_message("yue"), "en": config.transfer_message("en"), }, } ``` ```python def handle_start_ai_conversation(body: dict) -> dict: lang = body.get("AgentConfig", {}).get("Lang", "zh") use_avatar = bool(body.get("UseAvatar", False)) and config.is_avatar_enabled() # ... agent_cfg = { "UserId": body["AgentConfig"]["UserId"], "UserSig": body["AgentConfig"]["UserSig"], "TargetUserId": body["AgentConfig"]["TargetUserId"], "MaxIdleTime": 60, "WelcomeMessage": welcome, "WelcomeMessagePriority": 0, "TurnDetectionMode": 3, "TurnDetection": {"SemanticEagerness": "auto"}, "Filt ...[truncated 4489 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
assets/templates/customer_service.html:1582
Finding

Mutable Third-Party TRTC JavaScript Executes Without Integrity Verification

Content
View full analysis
``` The same insecure integration pattern is also recommended in `references/frontend-guide.md:23`. ### Technical Analysis The generated customer-service page loads the TRTC Web SDK at runtime from a third-party CDN. The URL identifies only the major SDK series (`v5`) rather than an immutable, audited release. The script element has no Subresource Integrity (`integrity`) metadata. Consequently, the effective JavaScript executed by the generated application may change after the Skill itself has been reviewed. Any compromise of the CDN, its publishing process, DNS/TLS trust path, or the mutable SDK asset could cause attacker-controlled JavaScript to execute in the application origin. Because third-party scripts execute with the same privileges as first-party page code, a modified SDK could access runtime TRTC UserSig credentials, inspect or alter conversation content, monitor microphone operations, invoke the unauthenticated `/action` endpoint, and manipulate the interface. ### Attack Path 1. A user opens the generated customer-service page. 2. The browser requests `trtc.js` from the mutable external CDN URL. 3. The CDN asset or its delivery path is compromised, or the mutable major-version resource is replaced with malicious code. 4. The browser executes the modified script with the application origin’s privileges. 5. The malicious script observes credentials returned by `/action`, monitors session metadata, alters TRTC behavior, or issues additional backend requests. 6. The attacker can then hijack active conversations, capture session credentials, or abuse cloud-backed operations available to the page. This attack requires compromise or unauthor ...[truncated 811 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (33)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a customer-service app builder, but the content primarily drives project generation, credential collection, UserSig signing, and TRTC/OpenAPI control flows, including authentication-related behavior not clearly declared in the skill contract. This mismatch reduces operator awareness and can cause users or agents to execute sensitive auth and network operations under misleading expectations.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · assets/static/app.js (reported line 448)May include surrounding context.

js
const msgId = STATE.aiRoundMsgId[roundid];
                if (msgId) updateMessage(msgId, STATE.aiRoundText[roundid] || text, { streaming: false });
                STATE.addedAIRounds.add(roundid);
                delete STATE.aiRoundText[roundid];
                delete STATE.aiRoundLast[roundid];
                delete STATE.aiRoundMsgId[roundid];
            }

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · assets/static/app.js (reported line 449)May include surrounding context.

js
const msgId = STATE.aiRoundMsgId[roundid];
                if (msgId) updateMessage(msgId, STATE.aiRoundText[roundid] || text, { streaming: false });
                STATE.addedAIRounds.add(roundid);
                delete STATE.aiRoundText[roundid];
                delete STATE.aiRoundLast[roundid];
                delete STATE.aiRoundMsgId[roundid];
            }

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · assets/static/app.js (reported line 450)May include surrounding context.

js
const msgId = STATE.aiRoundMsgId[roundid];
                if (msgId) updateMessage(msgId, STATE.aiRoundText[roundid] || text, { streaming: false });
                STATE.addedAIRounds.add(roundid);
                delete STATE.aiRoundText[roundid];
                delete STATE.aiRoundLast[roundid];
                delete STATE.aiRoundMsgId[roundid];
            }

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/templates/customer_service.html (reported line 1347)May include surrounding context.

html
</head>
<body>
    <div class="layout">
        <!-- ========== 顶部栏 ========== -->
        <div class="top-bar">
            <button class="top-bar-toggle" id="btn-toggle-sidebar">
                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12h18M3 6h18M3 18h18"/></svg>

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config-guide.md (reported line 205)May include surrounding context.

AvatarConfig: AvatarType: tencent # 数字人类型 Appkey: "" # 数字人 Appkey AccessToken: "" # 数字人 Access Token VirtualmanProjectId: "" # 数字人项目 ID

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to invoke the skill via very broad natural-language phrases like "help me build an AI customer service," which can overlap with ordinary development requests. In agents that auto-discover skills by description matching, this can cause unintended activation of the skill in contexts where the user did not explicitly request it, expanding the skill's influence over prompts and generated code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation guidance suggests generic keywords such as "AI customer service" and "e-commerce support," which are common phrases that may appear in normal conversations or unrelated tasks. This ambiguity increases the risk of accidental skill loading, causing unreviewed instructions, scaffolding behavior, or external dependency recommendations to be injected into the agent workflow without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Stating that the skill can be invoked implicitly via natural language without defining strict matching boundaries makes auto-discovery behavior unpredictable. In a coding assistant environment, this can lead to the skill being selected for broad customer-service-related prompts, giving it unintended control over implementation advice and setup steps.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该处说明安装后可通过类似“帮我做个 AI 客服”的自然语言直接调用 skill，但没有定义更严格的触发边界、优先级或确认机制。对支持自动发现/自动激活的代理框架而言，这会增加误触发风险，使普通对话在非预期场景下加载并执行该 skill。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

“AI 客服”“电商客服”“TRTC + AI”等关键词过于宽泛，且文档写明会自动激活，意味着日常讨论相关主题时也可能触发该 skill。误激活后，agent 可能引入额外指令、脚手架生成或配置流程，扩大非预期操作面。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

该描述同时允许隐式调用和显式调用，但未说明隐式调用需要满足的上下文条件或冲突处理规则。对于会根据 description 自动匹配的系统，这种模糊触发可能导致与其他客服、AI、TRTC 相关 skill 竞争匹配，造成错误加载。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill instructs the agent to run scaffolding scripts, create files, install dependencies, access external consoles and APIs, and start services, but it declares no explicit tool scope or permission boundaries. This creates an over-privileged execution model where an agent may use file, shell, and network capabilities without transparent user review, increasing the chance of unintended or unsafe actions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
|------|------|----------|
| scaffold.py 报错退出 | Python 版本或参数错误 | 确认 Python 3.8+；检查输出目录路径是否合法 |
| `start.sh` 报 Python 版本不够 | Python < 3.8 | 安装 Python 3.8+ |
| venv 创建失败 | 缺少 `python3-venv` 包 | Ubuntu/Debian: `sudo apt install python3-venv`；macOS 自带 |
| 依赖安装失败 | 网络问题 | `start.sh` 会自动 fallback 官方源；或手动 `pip install -r requirements.txt` |
| `env.yaml` 解析报错 | YAML 缩进或格式错误 | 用在线 YAML 校验器检查；常见：冒号后缺空格、中文引号 |
| 页面打开空白 | 静态文件缺失 | 确认 `static/app.js` 和 `templates/customer_service.html` 存在 |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/start.sh (reported line 383)May include surrounding context.

sh
|------|------|----------|
| scaffold.py 报错退出 | Python 版本或参数错误 | 确认 Python 3.8+；检查输出目录路径是否合法 |
| `start.sh` 报 Python 版本不够 | Python < 3.8 | 安装 Python 3.8+ |
| venv 创建失败 | 缺少 `python3-venv` 包 | Ubuntu/Debian: `sudo apt install python3-venv`；macOS 自带 |
| 依赖安装失败 | 网络问题 | `start.sh` 会自动 fallback 官方源；或手动 `pip install -r requirements.txt` |
| `env.yaml` 解析报错 | YAML 缩进或格式错误 | 用在线 YAML 校验器检查；常见：冒号后缺空格、中文引号 |
| 页面打开空白 | 静态文件缺失 | 确认 `static/app.js` 和 `templates/customer_service.html` 存在 |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script automatically selects only Chinese or non-Chinese messaging from the host locale and does not provide an explicit user opt-in or override. This is a natural-language policy concern because locale behavior is imposed implicitly rather than chosen by the user.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/start.sh (reported line 125)May include surrounding context.

sh
echo "  每步都可以按 Enter 跳过，稍后手动编辑 ${ENV_FILE}。"
        echo ""
        echo "  ⚠ 注意：密钥将以明文存储在 ${ENV_FILE} 中，"
        echo "    请勿提交到版本控制，建议设置 chmod 600 ${ENV_FILE}。"
    else
        echo "  You'll need 3 sets of credentials + 1 business config (~5 min)."
        echo "  Press Enter at any step to skip, then edit ${ENV_FILE} manually."

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/start.sh (reported line 131)May include surrounding context.

sh
echo "  每步都可以按 Enter 跳过，稍后手动编辑 ${ENV_FILE}。"
        echo ""
        echo "  ⚠ 注意：密钥将以明文存储在 ${ENV_FILE} 中，"
        echo "    请勿提交到版本控制，建议设置 chmod 600 ${ENV_FILE}。"
    else
        echo "  You'll need 3 sets of credentials + 1 business config (~5 min)."
        echo "  Press Enter at any step to skip, then edit ${ENV_FILE} manually."

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/start.sh (reported line 368)May include surrounding context.

sh
echo "  每步都可以按 Enter 跳过，稍后手动编辑 ${ENV_FILE}。"
        echo ""
        echo "  ⚠ 注意：密钥将以明文存储在 ${ENV_FILE} 中，"
        echo "    请勿提交到版本控制，建议设置 chmod 600 ${ENV_FILE}。"
    else
        echo "  You'll need 3 sets of credentials + 1 business config (~5 min)."
        echo "  Press Enter at any step to skip, then edit ${ENV_FILE} manually."

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The launcher identifies any process listening on port 8080 and offers to terminate it, without verifying that the process belongs to this application. A user who accepts the prompt could inadvertently kill unrelated local services, causing denial of service or data loss if the target process is performing important work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file sends conversation payloads to '/action' via fetch and later forwards user text and order information to the AI service, but the code does not present any disclosure, confirmation, or warning to the user that their inputs and contextual data will be transmitted off the page. For a customer-service voice/text skill handling chat content and order metadata, this is a safety-relevant network operation that should be disclosed somewhere user-visible if not already covered in markdown documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Line L315 states the language setting defaults by following the browser, but elsewhere the document presents Chinese (zh) as the primary/default prompt and message set, and does not clearly offer an explicit opt-in before applying locale-specific behavior. This can be a language/locale policy concern because the skill behavior is biased toward a specific language configuration rather than clearly requiring user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file instructs the frontend to call startLocalAudio() and begin voice capture, but the surrounding documentation does not mention prompting the user, disclosing microphone activation, or warning about audio transmission. Because microphone access affects user privacy, the skill description should explicitly tell implementers to provide notice and obtain consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This section explains that typed text is sent directly to the LLM, but it does not include any warning that user-entered content leaves the client and is processed remotely. For markdown guidance, omission of privacy-impact disclosures is in scope when the behavior could affect user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code creates directories and then writes files such as app.py, README.md, start.sh, and copied asset files directly into the chosen output path, potentially replacing existing content. Although this is part of a scaffold generator's purpose, the file itself lacks a confirmation prompt or explicit disclosure that existing files in the destination may be overwritten.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/config-guide.md:47