ClawHub
Back to skill

Security audit

Recipe - 菜谱大全

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward recipe lookup integration that uses a declared Jisu API key and sends recipe queries to the documented Jisu recipe API.

Install only if you are comfortable providing a JisuAPI AppKey and sending recipe search terms, class IDs, and recipe IDs to JisuAPI. Treat returned image URLs as untrusted remote media, especially if they use plain HTTP, and avoid automatically rendering them in sensitive environments.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documentation declares requirements for environment access and implicitly relies on network access to call a third-party API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may invoke broader capabilities than users or platform policy expect, increasing the risk of unintended secret use or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill name and invocation guidance are entirely in Chinese, and the description tells the agent to use the skill when the user says Chinese recipe requests. There is no indication that language choice is optional or that the skill is intentionally limited to Chinese-speaking users for a documented regional reason.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

The skill examples include external resource URLs using plain HTTP rather than HTTPS. If clients fetch these image URLs, responses can be intercepted or modified in transit, enabling content tampering, tracking, or delivery of malicious payloads through downstream renderers.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
"preparetime": "10-20分钟",
      "cookingtime": "10-20分钟",
      "content": "……",
      "pic": "http://api.jisuapi.com/recipe/upload/20160719/115138_46688.jpg",
      "tag": "减肥,家常菜,排毒,补钙",
      "material": [
        {

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

This example contains another plain-HTTP external image URL. Any automatic retrieval of this content exposes users or systems to man-in-the-middle modification and privacy leakage because requests and responses are not protected by transport encryption.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
"process": [
        {
          "pcontent": "准备食材。",
          "pic": "http://api.jisuapi.com/recipe/upload/20160719/162550_84583.jpg"
        }
      ]
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

The documented API response includes a third-party image URL over HTTP. In a skill that may surface these links to users or fetch them programmatically, this makes tampering and passive observation of traffic feasible on hostile networks.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
"preparetime": "10分钟内",
  "cookingtime": "10分钟内",
  "content": "……",
  "pic": "http://api.jisuapi.com/recipe/upload/20160719/115138_19423.jpg",
  "tag": "减肥,咸香,宴请,抗氧化,抗衰老,私房菜,聚会",
  "material": [
    {

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

This is another insecure external transmission example using HTTP for image content. Repeated insecure media references increase the chance that integrators will treat such URLs as acceptable and inadvertently introduce unsafe network fetching into the agent workflow.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md
"process": [
    {
      "pcontent": "彩椒，红萝卜切丝",
      "pic": "http://api.jisuapi.com/recipe/upload/20160719/162546_72503.jpg"
    }
  ]
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · recipe.py (reported line 14)May include surrounding context.

python
import requests


RECIPE_SEARCH_URL = "https://api.jisuapi.com/recipe/search"
RECIPE_CLASS_URL = "https://api.jisuapi.com/recipe/class"
RECIPE_BYCLASS_URL = "https://api.jisuapi.com/recipe/byclass"
RECIPE_DETAIL_URL = "https://api.jisuapi.com/recipe/detail"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · recipe.py (reported line 15)May include surrounding context.

python
import requests


RECIPE_SEARCH_URL = "https://api.jisuapi.com/recipe/search"
RECIPE_CLASS_URL = "https://api.jisuapi.com/recipe/class"
RECIPE_BYCLASS_URL = "https://api.jisuapi.com/recipe/byclass"
RECIPE_DETAIL_URL = "https://api.jisuapi.com/recipe/detail"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · recipe.py (reported line 16)May include surrounding context.

python
import requests


RECIPE_SEARCH_URL = "https://api.jisuapi.com/recipe/search"
RECIPE_CLASS_URL = "https://api.jisuapi.com/recipe/class"
RECIPE_BYCLASS_URL = "https://api.jisuapi.com/recipe/byclass"
RECIPE_DETAIL_URL = "https://api.jisuapi.com/recipe/detail"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · recipe.py (reported line 17)May include surrounding context.

python
import requests


RECIPE_SEARCH_URL = "https://api.jisuapi.com/recipe/search"
RECIPE_CLASS_URL = "https://api.jisuapi.com/recipe/class"
RECIPE_BYCLASS_URL = "https://api.jisuapi.com/recipe/byclass"
RECIPE_DETAIL_URL = "https://api.jisuapi.com/recipe/detail"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends recipe search parameters and the API key to a third-party service via HTTP requests, which is a network transmission of user/system data. While the module docstring names the API provider, there is no runtime confirmation, warning comment near the call site, or explicit disclosure that user inputs will be sent off-system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.