ClawHub
Back to skill

Security audit

IP地址归属、信誉、风控查询

Security checks for vulnerabilities and agentic risk

Overview

The skill is a clearly scoped IP reporting tool with consent-gated network lookups, though users should protect generated reports because the code does not enforce private file permissions.

Install only for authorized single-IP checks. Use external lookups only after confirming the IP and provider domains, avoid customer/account logs or identity profiling, keep API keys in environment variables only, and store generated reports in a private directory with restrictive permissions or a secure umask.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ip_intelligence.py:1455
Finding

Generated IP Intelligence Reports Are Written Without Restrictive File Permissions

Content
View full analysis
Remediation
View remediation
None: flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC fd = os.open(path, flags, 0o600) try: os.fchmod(fd, 0o600) with os.fdopen(fd, "w", encoding="utf-8") as handle: fd = -1 handle.write(content) finally: if fd >= 0: os.close(fd) ``` 3. Use the private writer for JSON, HTML, Markdown, and all `--output` paths. 4. Consider atomic replacement using a private temporary file in the destination directory, followed by `os.replace()`. Ensure the temporary file is also created with mode `0o600`. 5. Reject symbolic-link destinations or open files with `O_NOFOLLOW` where supported if output paths may be located in directories writable by untrusted users. 6. Add tests that set a permissive umask and verify: - Report directories have mode `0o700`. - Every generated report has mode `0o600`. - Pre-existing broadly readable output files are corrected to `0o600`. - Symlink destinations are rejected or handled safely. 7. Document that stdout output remains controlled by the caller and may be captured by shell history, pipelines, CI logs, or job schedulers. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose is narrow IP intelligence analysis, but the detected behavior includes repository auditing, filesystem inspection, and scanning for secrets and compliance artifacts. That mismatch is dangerous because users may authorize the skill for one bounded task while it actually traverses local project contents, potentially exposing sensitive source code, credentials, or internal documents unrelated to the requested IP check.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
python scripts/ip_intelligence.py 8.8.8.8 --format json

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
python scripts/ip_intelligence.py 8.8.8.8 --format json

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
python scripts/ip_intelligence.py 8.8.8.8 --format json

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope despite having capabilities for environment access, file read/write, network, and shell. In an agent setting, this creates an over-privileged execution surface where the skill can access local data or make network calls beyond what a reviewer would expect from the manifest, weakening containment and user consent controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ip_intelligence.py (reported line 862)May include surrounding context.

python
def lookup_ipinfo(ip: str, timeout: float) -> Dict[str, Any]:
    token = os.environ["IPINFO_TOKEN"]
    raw = request_json(f"https://api.ipinfo.io/lite/{urllib.parse.quote(ip)}", timeout,
                       {"Authorization": f"Bearer {token}"})
    privacy = raw.get("privacy") if isinstance(raw.get("privacy"), Mapping) else {}
    asn_obj = raw.get("asn") if isinstance(raw.get("asn"), Mapping) else {}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ip_intelligence.py (reported line 885)May include surrounding context.

python
def lookup_abuseipdb(ip: str, timeout: float) -> Dict[str, Any]:
    url = with_query("https://api.abuseipdb.com/api/v2/check", {"ipAddress": ip, "maxAgeInDays": 90, "verbose": "true"})
    raw = request_json(url, timeout, {"Key": os.environ["ABUSEIPDB_API_KEY"], "Accept": "application/json"})
    item = raw.get("data") if isinstance(raw.get("data"), Mapping) else {}
    if item.get("ipAddress") != ip:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release_audit.py (reported line 42)May include surrounding context.

python
def tracked_files(root: Path) -> List[Path]:
    try:
        completed = subprocess.run(
            ["git", "-C", str(root), "ls-files", "-z"],
            check=False, capture_output=True, text=False,
        )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ip_intelligence.py (reported line 764)May include surrounding context.

python
class ExternalPolicyTests(unittest.TestCase):
    def test_external_url_requires_allowlisted_https_without_credentials(self):
        accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ip_intelligence.py (reported line 795)May include surrounding context.

python
class ExternalPolicyTests(unittest.TestCase):
    def test_external_url_requires_allowlisted_https_without_credentials(self):
        accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 114)May include surrounding context.

python
class ExternalPolicyTests(unittest.TestCase):
    def test_external_url_requires_allowlisted_https_without_credentials(self):
        accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 121)May include surrounding context.

python
class ExternalPolicyTests(unittest.TestCase):
    def test_external_url_requires_allowlisted_https_without_credentials(self):
        accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 122)May include surrounding context.

python
class ExternalPolicyTests(unittest.TestCase):
    def test_external_url_requires_allowlisted_https_without_credentials(self):
        accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 139)May include surrounding context.

python
class ExternalPolicyTests(unittest.TestCase):
    def test_external_url_requires_allowlisted_https_without_credentials(self):
        accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 685)May include surrounding context.

python
class ExternalPolicyTests(unittest.TestCase):
    def test_external_url_requires_allowlisted_https_without_credentials(self):
        accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 117)May include surrounding context.

python
accepted = intel.validate_external_url("https://api.ipapi.is/?q=8.8.8.8")
        self.assertEqual(accepted.hostname, "api.ipapi.is")
        for url in (
            "http://api.ipapi.is/?q=8.8.8.8",
            "https://evil.example/?q=8.8.8.8",
            "https://api.ipapi.is:8443/?q=8.8.8.8",
            "https://user:password@api.ipapi.is/?q=8.8.8.8",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 271)May include surrounding context.

python
def test_unexpected_failure_does_not_escape(self):
        def explode(ip, timeout):
            raise RuntimeError("secret at https://api.example.test/?key=super-secret")
        provider = intel.Provider("broken", "Broken", "risk", explode)
        actual = intel.run_provider(provider, "8.8.8.8", 1)
        self.assertEqual(actual.status, "error")

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · tests/test_ip_intelligence.py (reported line 632)May include surrounding context.

python
self.assertNotIn(dangerous, rendered)
        self.assertIn("type=\"application/octet-stream\"", rendered)
        self.assertIn("risk_provider_order", json.loads(
            __import__("base64").b64decode(
                rendered.split('id="report-data">', 1)[1].split("</script>", 1)[0]
            ).decode("utf-8")
        )["presentation"])