ClawHub
Back to skill

Security audit

IP地址归属、信誉、风控查询

Security checks for vulnerabilities and agentic risk

Overview

The skill is a clearly scoped single-IP intelligence tool with local-only defaults, explicit external-query confirmation, and no hidden persistence or unrelated runtime behavior.

Install only for authorized checks of a single public IP. Use local-only mode unless you are comfortable sending the IP to the listed external providers, keep any generated reports in controlled storage, and configure provider API keys only through the documented environment variables.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill text describes operational behaviors that imply shell, filesystem, environment, and network use, but no explicit permissions are declared. That creates a transparency and governance gap: operators may approve or run the skill without understanding its actual capability to read/write files, access environment-held secrets, or make outbound requests after confirmation. In a security-sensitive agent ecosystem, undeclared capabilities increase the chance of overbroad execution and reduce the effectiveness of policy enforcement and review.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
A skill advertised as single-IP intelligence lookup should not also contain independent repository/source-release auditing behavior such as scanning project files, invoking git ls-files, or checking for secrets and unapproved URLs. That mismatch materially expands the data-access scope from one authorized IP to potentially the entire local source tree and release artifacts, which can expose sensitive code, tokens, internal URLs, or unpublished content beyond the user's expected consent. The deceptive or incomplete description makes the skill more dangerous because users may grant trust or execution based on a much narrower stated purpose.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_ip_intelligence.py:17