Security audit

clawagent

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real marketing automation skill, but it needs review because it can install global tooling, store tokens, upload files, check arbitrary URLs, and publish to social accounts without tight guardrails.

Install only in an environment where global npm changes and home-scoped mcporter token storage are acceptable. Use a low-privilege or temporary token, do not upload sensitive or rights-restricted media, and require a manual confirmation before any social media publish action or update command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The setup script installs a global package with `npm install -g`, which modifies the host environment outside the skill's core marketing/content-generation purpose. Even if intended for convenience, automatic global installation expands the skill's privileges, creates supply-chain risk if the package or dependency chain is compromised, and can affect other software on the system.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The script executes host shell commands (`which`/`where`, `mcporter`, `npm`) to inspect and configure the local environment. While common in installers, this exceeds the stated business function of a marketing agent and creates a broader attack surface because the skill gains environment-discovery and host-configuration capabilities that could be abused if the script or invoked binaries are malicious or replaced on PATH.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description says to invoke the skill whenever a user needs AIGC content generation or social media operations, which is a very broad routing condition. Broad activation increases the chance the agent will invoke this skill in unrelated contexts, potentially sending user prompts, files, or URLs to an external service without sufficiently specific user intent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Many trigger phrases are generic expressions such as '分析一下', '发视频', or '做海报', which are common in ordinary conversation and can cause accidental skill activation. In this skill, unintended activation is more dangerous because the skill can upload files, contact remote infrastructure, and manage social media accounts, turning misrouting into privacy or integrity risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs users to provide public URLs for videos, images, and audio to an external AI video-generation workflow, but it does not warn that these assets will be transmitted to a third-party service and may contain personal, copyrighted, or sensitive content. In a marketing/AIGC platform context, users are especially likely to upload brand assets or identifiable media, so the omission increases the risk of unintended data disclosure and compliance violations.

External Script Fetching

High

Category: Supply Chain
Content: **公网URL**： - 必须先验证可访问性：`curl -I --max-time 5 -L <URL>` - HTTP 200 → 直接传入工具 - 403/401 → 告知"链接需要登录或权限" - 404 → 告知"链接已失效"
Confidence: 95% confidence
Finding: curl -I --max-time 5 -L <URL>` - HTTP 200 → 直接传入工具 - 403/401 → 告知"链接需要登录或权限" - 404 → 告知"链接已失效" - 超时/失败 → 告知"链接无法访问" **本地文件路径**： - 需上传到云存储获取公网URL，见下方[上传规则](#文件上传规则) **引用文件**（@image、@file等）： - 告知用户"

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: setup.mjs:30