ClawHub

支持发送文件到飞书，大于20MB自动分卷裁切

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Feishu file-sending helper, but it should only be used when you intend to upload the selected local file to Feishu.

Install only if you want this skill to upload chosen local files to Feishu. Verify the exact file path and recipient before running it, use a least-privileged Feishu app, protect FEISHU_APP_SECRET and any .env file, and prefer preinstalling/pinning requests instead of relying on runtime pip installation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def install_python_package(package):
    print(f'正在安装 Python 依赖: {package}...')
    try:
        subprocess.check_call([sys.executable, '-m', 'pip', 'install', package], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        print(f'{package} 安装成功')
        return True
    except subprocess.CalledProcessError:
Confidence
84% confidence
Finding
subprocess.check_call([sys.executable, '-m', 'pip', 'install', package], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def install_python_package(package):
    print(f'正在安装 Python 依赖: {package}...')
    try:
        subprocess.check_call([sys.executable, '-m', 'pip', 'install', package], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        print(f'{package} 安装成功')
        return True
    except subprocess.CalledProcessError:
Confidence
92% confidence
Finding
subprocess.check_call([sys.executable, '-m', 'pip', 'install', package], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill clearly uses sensitive capabilities—reading local files, accessing environment variables and a local .env, invoking shell tools, and sending data over the network—but does not declare equivalent permissions in a user-visible way. This undermines informed consent and makes exfiltration-prone behavior harder for users or policy systems to evaluate before use.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented behavior does not fully match the described capabilities: it may auto-install dependencies, read secrets from .env, inspect neighboring files for audio/video pairing, and re-encode some media despite claiming otherwise. That mismatch is dangerous because users may authorize a narrower action while the skill performs broader filesystem access, code execution via package installation, and data transformations they did not expect.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The ZIP 'splitting' logic does not actually split data; it recreates multiple ZIP files each containing the entire original ZIP. This can cause repeated unintended exfiltration of the full file, misleading users into thinking large-file handling is safe and bounded when it actually duplicates sensitive content across multiple uploads.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill's core purpose is uploading local files to an external Feishu service, yet the description lacks a prominent warning that file contents leave the local system. Without an explicit disclosure, users may unintentionally transmit sensitive documents, media, or archives to a third party.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script modifies the runtime environment by installing Python packages automatically without explicit confirmation. In a skill that already handles sensitive local files and credentials, silent dependency installation increases supply-chain exposure and can surprise users or violate locked-down environments.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script silently loads credentials from a local .env in the skill directory and later uses them for network authentication. In the context of a file-sending skill, implicit credential discovery reduces transparency and can cause users to unknowingly expose organization-linked app credentials.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This function uploads arbitrary local file contents to an external Feishu API without any explicit confirmation or data-loss-prevention checks. Given the skill's purpose is sending arbitrary local files, the context makes accidental exfiltration especially dangerous because sensitive files can be transmitted off-host with a single invocation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Automatically installing Python packages at runtime without explicit approval introduces supply-chain exposure and changes the host environment unexpectedly. In an agent skill context, this is especially risky because users may execute the tool with elevated trust and local file access.

Credential Access

High
Category
Privilege Escalation
Content
## 配置

### 方式一：.env 文件（推荐）

在技能目录下创建 `.env` 文件：
Confidence
78% confidence
Finding
.env

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal