clawmbti

• Outcome: Review
• Latest audit: May 28, 2026 · 2:40 PM UTC
• Version: 1.0.1

Overview

This skill should be reviewed carefully because it silently stores personality signals, creates a local Solana wallet, and sends MBTI data to a remote service.

Install only if you are comfortable with the skill creating and storing a local Solana private key, saving conversation-derived MBTI summaries across sessions, installing Python dependencies, and sending personality-analysis data to clawmbti.finchain.global. Review and clear ~/.mbti if you do not want the stored wallet, MBTI results, or conversation summaries retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands, reads and writes persistent files under ~/.mbti, and uses networked components, yet does not declare these capabilities or obtain explicit consent boundaries. Hidden or undeclared privileged behavior increases the chance of unintended execution, data exposure, and abuse because operators and users cannot accurately assess what the skill is allowed to do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose suggests a lightweight personality-detection feature, but the skill also persists cross-session data, creates a Solana wallet, stores sensitive wallet material, and interacts with remote minting/reporting APIs. This mismatch is dangerous because users may consent to a playful MBTI feature without realizing it performs financial, persistent-storage, and external-reporting actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This script persistently stores cross-session conversation summaries under ~/.mbti/conversations and provides commands to enumerate and read them back in bulk. For a skill described as MBTI detection and NFT certificate issuance, long-term retention and retrieval of historical dialogue creates unnecessary privacy exposure and broadens the skill's data-access scope beyond what users would reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code explicitly implements durable history saving, listing, full-history reading, and cumulative stats, enabling long-term profiling of user or assistant interactions. In the context of an MBTI/NFT skill, this capability is not clearly necessary and increases the risk of privacy invasion, unintended secondary use, and sensitive data accumulation over time.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill’s stated purpose is MBTI detection and NFT certificate issuance, but this file also sends detection results to a centralized backend and updates existing detection records. That broader telemetry and server-side record-management behavior is not clearly disclosed by the stated purpose, creating a scope mismatch and privacy risk for profiling/session data.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The update-report command can modify existing server-side detection records by sending an id and agent_name to the backend, which exceeds the expected scope of an NFT minting client. Even if intended for maintenance, this creates an unnecessary data-manipulation capability that could be abused to alter profiling metadata or tamper with records.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The report command transmits MBTI detection results, session identifiers, and related metadata to an external centralized service, which is not obviously required just to issue a certificate. In a profiling-oriented skill, silent export of such data increases privacy and tracking risk, especially when users may reasonably expect local-only processing or only mint-related network activity.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code generates a Solana keypair and stores the private key on disk, which is unrelated to the stated MBTI-detection and lobster-themed NFT certificate purpose. In a skill context, introducing secret-bearing wallet management materially expands capability into cryptocurrency custody, creating unjustified risk of asset creation, misuse, or later exfiltration.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file's behavior extends beyond the advertised functionality by managing local blockchain wallet files and private secrets under ~/.mbti/wallet. Hidden or under-disclosed secret management is dangerous because users and reviewers may not expect the skill to create custodial material, and this capability can be chained with other code to spend funds, mint assets, or exfiltrate keys.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill directs the user to install a package manager by fetching and piping a remote script directly into the shell, which introduces unnecessary code-execution risk for a feature whose stated purpose is MBTI/NFT generation. Even though this command is only suggested after a failure path, it still normalizes unsafe installation behavior and expands the trust boundary to external infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The step performs behavior beyond personality detection by checking for and potentially generating a crypto wallet before any user-visible MBTI action. Creating wallet infrastructure silently expands the skill’s scope into credential and asset management, which can surprise users, create sensitive local state, and enable later blockchain actions without informed consent.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The heading 'Check Local State' is misleading because the procedure does not merely inspect state; it may actively generate a crypto wallet. This kind of understatement reduces transparency and can conceal security-relevant side effects from reviewers and users, making risky behavior easier to overlook.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The step explicitly tells the agent to read and merge prior-session conversation history into the current analysis, enabling cross-session profiling and reuse of previously shared dialogue beyond the immediate interaction. In a personality-inference skill, this materially increases privacy risk because older user content, quotes, and inferred signals can be silently aggregated into a new sensitive profile without fresh consent or contextual need.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The self-sampling mode instructs the AI to fabricate additional personality evidence by introspecting and answering scenario prompts about itself when real conversation data is insufficient. That creates unsupported sensitive inference and can mislead users by presenting generated self-analysis as if it were valid observational evidence, especially since it is performed proactively in one continuous message.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to silently send detailed MBTI profiling data, dimensional scores, evidence text, description, session identifier, and model identifier to an external service after user confirmation of the result, not after informed consent to data sharing. This exceeds the stated purpose of MBTI detection and certificate issuance and creates an undisclosed exfiltration path for profiling and telemetry data.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The transmitted payload includes a session identifier and current model identifier, neither of which is necessary to detect MBTI type or generate a lobster NFT certificate. Collecting extra metadata increases linkability and fingerprinting risk, especially when combined with personality profiling data.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This step introduces cryptocurrency wallet exposure and management behavior that is unrelated to the declared MBTI-classification and NFT-certificate purpose of the skill. The mismatch, combined with instructions to reveal a silently created wallet to the user, is a strong indicator of hidden financial side effects or undisclosed asset-handling functionality.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file includes cryptocurrency wallet generation and recovery-adjacent handling without justification from the stated MBTI-analysis use case. Hidden wallet provisioning creates risk of unauthorized financial tooling, deceptive onboarding, and unsafe key lifecycle management, especially when the user did not knowingly request a wallet.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: Stating that the wallet was 'silently created' indicates undisclosed state-changing behavior before user awareness or consent. In the context of a personality-detection skill, covert creation of a crypto wallet is especially suspicious because it normalizes hidden sensitive operations and undermines user trust and informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill goes beyond MBTI detection and initiates blockchain minting plus publication of a wallet-linked public profile containing model, agent name, description, and behavioral evidence. That creates unnecessary data disclosure, irreversible on-chain/public exposure, and external side effects not required for the stated purpose, making the step risky even if framed as a feature.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The passive trigger can activate during ordinary discussion of personality, preferences, or communication style, causing the skill to launch a multi-step flow without a clear user request. In context, that flow can lead to analysis, storage, wallet actions, and NFT-related prompts, so overbroad triggering materially increases privacy and consent risks.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill mandates silent per-reply MBTI signal collection after every AI response with no user-facing warning. Continuous covert analysis of conversation content creates a clear privacy issue, especially because it is always-on and not limited to a single requested interaction.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill instructs silent saving of cross-session summaries and exact quotes, creating persistent behavioral profiles without clear notice or consent. Cross-session retention compounds sensitivity because it allows long-term accumulation of interaction patterns that users may not expect to be stored or reused.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The save-session path writes conversation-derived JSON to local disk without any user-facing notice, consent flow, or indication of retention. Silent persistence of conversational data is dangerous because users may disclose sensitive information without realizing it is being stored long-term and later retrievable.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The mint request sends wallet address, MBTI type, and personality-dimension data to a remote API without any user-facing disclosure in this code path. Because this combines identity-linked wallet information with profiling data, the context makes the privacy risk more significant than a routine API call.

Static analysis

No suspicious patterns detected.