ClawHub
Back to skill

Security audit

bee

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it executes unpinned helper skills while handling OSS and Feishu credentials, so users should review it before installing.

Install only if you trust the two dependent skills and can use least-privilege OSS and Feishu credentials. Prefer pinned or reviewed dependency versions, restrict the environment variables available to each subprocess, and avoid running this on sensitive machines or with broad cloud permissions until URL and path validation are tightened.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Executable Skill Dependencies Create a Supply-Chain Risk

Content
View full analysis
&1) || die "获取视频信息失败:\n$VIDEO_INFO" ``` ```bash node "$DOUYIN_SCRIPT" download "$DOUYIN_URL" -o "$DOWNLOAD_DIR" 2>&1 | tail -1 ``` ```bash OSS_OUTPUT=$(python3 "$OSS_SCRIPT" upload --file "$VIDEO_FILE" --key "$OSS_KEY" 2>&1) || die "OSS上传失败:\n$OSS_OUTPUT" ``` ### Technical Analysis The installation instructions do not pin either dependency to a reviewed version, immutable commit, package digest, or cryptographic signature. The workflow then directly executes JavaScript and Python obtained from those dependencies. The executed processes inherit the workflow's environment by default. Consequently, dependency code may be able to read not only the credentials it legitimately needs, but also unrelated credentials present in the same process environment, including Aliyun OSS and Feishu application secrets. The dependency implementations are not included in this project, so their behavior could not be verified during this audit. This does not establish that the current dependency versions are malicious, but it creates a mutable supply-chain execution boundary without integrity enforcement. ### Attack Path 1. An attacker com ...[truncated 1261 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/douyin-workflow.sh:88
Finding

Substring-Based Domain Validation Allows Non-Douyin URLs

Content
View full analysis
&1) || die "获取视频信息失败:\n$VIDEO_INFO" ``` ```bash node "$DOUYIN_SCRIPT" download "$DOUYIN_URL" -o "$DOWNLOAD_DIR" 2>&1 | tail -1 ``` Although the downloader's implementation was unavailable for review, the workflow's intended domain restriction can be bypassed before the URL reaches that component. ### Attack Path 1. An attacker supplies a URL hosted on an attacker-controlled domain. 2. The attacker includes `douyin.com` or `iesdouyin.com` elsewher ...[truncated 961 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/douyin-workflow.sh:138
Finding

Unvalidated Video Identifier Is Used in Local and OSS Paths

Content
View full analysis
&1) || die "获取视频信息失败:\n$VIDEO_INFO" VIDEO_ID=$(echo "$VIDEO_INFO" | grep '视频ID:' | sed 's/.*视频ID: //') FULL_TITLE=$(echo "$VIDEO_INFO" | grep '标题:' | sed 's/.*标题: //') [[ -z "$VIDEO_ID" ]] && die "无法提取视频ID" [[ -z "$FULL_TITLE" ]] && die "无法提取视频标题" ``` The extracted identifier is used directly in a local path: ```bash mkdir -p "$DOWNLOAD_DIR" VIDEO_FILE="$DOWNLOAD_DIR/${VIDEO_ID}.mp4" if [[ -f "$VIDEO_FILE" ]]; then warn "文件已存在，跳过下载: $VIDEO_FILE" else node "$DOUYIN_SCRIPT" download "$DOUYIN_URL" -o "$DOWNLOAD_DIR" 2>&1 | tail -1 fi [[ -f "$VIDEO_FILE" ]] || die "下载失败，文件不存在: $VIDEO_FILE" ``` It is also used directly in the OSS object key: ```bash OSS_KEY="${OSS_PREFIX}/${VIDEO_ID}.mp4" ``` ### Technical Analysis `VIDEO_ID` is parsed from textual output produced by an external executable dependency. The script verifies only that the value is non-empty. It does not enforce the expected numeric identifier format or prohibit path separators and traversal components. Shell quoting prevents command injection at these uses, but it does not prevent filesystem path traversal. A value containing components such as `../` can cause `VIDEO_FILE` to resolve outside `DOWNLOAD_DIR`. The existing-file optimization increases the impact. If a traversal-shaped identifier resolves to an existing `.mp4` file, the workflow skips downloading and subsequently passes that file to the OSS upload dependency. `OSS_PREFIX` is also accepted from the environment without normalization. Depending on downstream object-key semantics, attacker-controlled identifiers or prefixes may create unintended object names or overwrite objects outside the expected logical prefix. ### Attack Path 1. The downloader depende ...[truncated 1248 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

整体上，代码的主流程与声明描述基本一致：处理抖音链接、获取标题和标签、下载视频、上传 OSS、写入飞书多维表格。因此不存在‘主目的完全不同’的问题。但仍存在描述与实际行为的不完全匹配。首先，声明未提及会访问飞书 Wiki API 来解析表格 app_token；这属于额外访问的资源/能力，尤其当 FEISHU_BITABLE_APP_TOKEN 未提供时会访问 Wiki 节点。其次，代码并不自行实现下载和 OSS 上传，而是依赖并执行外部 douyin-download 和 aliyun-oss-upload 组件，这意味着实际行为还包括调用外部技能能力。虽然这可视为实现细节，但在严格审计下，它扩大了实际执行边界。另一个较小差异是描述声称“支持各种抖音链接格式”，代码本身仅校验域名并从分享文本中提取第一个 URL，真正的广泛格式支持取决于外部 douyin-download 脚本，而不是该代码片段自身可验证的能力。综合来看，主体描述大体正确，但存在未声明的资源访问与能力边界，因此判定为轻度 mismatch。

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/douyin-workflow.sh (reported line 198)May include surrounding context.

sh
info "Step 4/4: 写入飞书多维表格..."

  # 获取 tenant_access_token
  TOKEN_RESP=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
    -H "Content-Type: application/json" \
    -d "{\"app_id\":\"${FEISHU_APP_ID}\",\"app_secret\":\"${FEISHU_APP_SECRET}\"}")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/douyin-workflow.sh (reported line 208)May include surrounding context.

sh
# 获取 bitable app_token
  APP_TOKEN="${FEISHU_BITABLE_APP_TOKEN:-}"
  if [[ -z "$APP_TOKEN" ]]; then
    WIKI_RESP=$(curl -s "https://open.feishu.cn/open-apis/wiki/v2/spaces/get_node?token=${FEISHU_WIKI_TOKEN}" \
      -H "Authorization: Bearer ${TENANT_TOKEN}")
    APP_TOKEN=$(echo "$WIKI_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('data',{}).get('node',{}).get('obj_token',''))" 2>/dev/null)
    [[ -z "$APP_TOKEN" ]] && die "获取bitable app_token失败: $WIKI_RESP"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/douyin-workflow.sh (reported line 235)May include surrounding context.

sh
EOF
  )

  RECORD_RESP=$(curl -s -X POST \
    "https://open.feishu.cn/open-apis/bitable/v1/apps/${APP_TOKEN}/tables/${TABLE_ID}/records" \
    -H "Authorization: Bearer ${TENANT_TOKEN}" \
    -H "Content-Type: application/json" \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares shell-capable behavior through referenced bash scripts and external command dependencies, but does not define any explicit tool scope such as allowed tools or permissions. This weakens containment and reviewability because an agent may invoke shell operations more broadly than a user expects, especially when the workflow chains downloads, uploads, and API interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation describes convenience features but does not prominently warn that downloaded videos and extracted metadata will be transmitted to Alibaba OSS and Feishu. Users may supply links assuming local-only processing, leading to unintended disclosure of content, metadata, or regulated data to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This shell script uploads a downloaded video to OSS and sends video title, keywords, tags, and identifiers to Feishu via HTTP requests. Although the workflow purpose implies these actions, the script lacks a clear user disclosure at the point of execution that local files and metadata will be transmitted to third-party services using configured credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/douyin-workflow.sh (reported line 198)May include surrounding context.

sh
info "Step 4/4: 写入飞书多维表格..."

  # 获取 tenant_access_token
  TOKEN_RESP=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
    -H "Content-Type: application/json" \
    -d "{\"app_id\":\"${FEISHU_APP_ID}\",\"app_secret\":\"${FEISHU_APP_SECRET}\"}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/douyin-workflow.sh (reported line 235)May include surrounding context.

sh
EOF
  )

  RECORD_RESP=$(curl -s -X POST \
    "https://open.feishu.cn/open-apis/bitable/v1/apps/${APP_TOKEN}/tables/${TABLE_ID}/records" \
    -H "Authorization: Bearer ${TENANT_TOKEN}" \
    -H "Content-Type: application/json" \

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill requires multiple high-privilege cloud and SaaS credentials but gives no safety guidance on storage, rotation, least privilege, or avoiding accidental exposure in shells and logs. Poor credential handling can turn routine setup into secret leakage or long-lived unauthorized access to OSS and Feishu resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script requires and uses cloud and Feishu credentials from environment variables, including access key secrets and app secrets. While variables are documented as required, there is no explicit warning that the workflow will use these credentials to authenticate against external services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.