ClawHub
Back to skill

Security audit

Anti Cheating Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent business-risk assistant, but it sends or embeds potentially sensitive business workflow data and an API key flow through external services without enough user consent, scoping, or privacy handling.

Review before installing. Use this skill only with business information you are willing to send to the listed hdconsultatio.com services, avoid entering secrets directly in chat, and prefer redacted or generic workflow descriptions unless the publisher provides clear consent, retention, and API-key handling guarantees.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/three_flow_graph_analysis.py:81
Finding

Disclosure of Business Workflow Data Through an External URL Query String

Content
View full analysis

Vulnerability Details

File Location: scripts/three_flow_graph_analysis.py:81
Vulnerability Type: Sensitive data exposure through URL parameters
Risk Level: Medium

Vulnerable Code

python
"three_flow_graph": f"https://hdconsultatio.com/mermaid.html?business_name={quote(business_name)}&std_info={quote(json.dumps(business_step_infos))}",

Technical Analysis

The script serializes the user-supplied business name and complete workflow description into the query string of a URL hosted by hdconsultatio.com. The workflow can include business roles, process steps, visibility relationships, and controllability information.

Percent-encoding with quote() only makes values safe for inclusion in a URL; it does not encrypt or redact them. Anyone with access to the URL can decode the information. If the generated link is opened, copied, or shared, sensitive workflow data may be exposed through:

  • The external visualization server and its access logs
  • Browser history and bookmarks
  • Forward proxies, security gateways, and monitoring systems
  • Analytics or observability platforms
  • Screenshots, chat transcripts, and copied links
  • Referrer information, depending on browser and destination policy

The implementation does not perform sensitivity detection, field minimization, redaction, or explicit consent collection before constructing the external link.

Attack Path

  1. A user provides a proprietary business name and detailed workflow to the Skill.
  2. The workflow reaches main() through params["std_info"].
  3. The script serializes the complete workflow with json.dumps().
  4. The serialized data is placed in the std_info URL query parameter.
  5. The Skill returns the generated external URL.
  6. When the user or agent opens or shares the URL, the business data is transmitted to the external host and may be retained by intermediary or endpoint logging systems.
  7. Any party with access ...[truncated 631 chars]
Remediation
View remediation

Remediation Suggestions

  1. Avoid putting workflow data in URL query parameters.
  2. Prefer local graph rendering so user data does not leave the execution environment.
  3. If remote rendering is necessary, obtain explicit user consent and transmit the payload using an authenticated HTTPS POST request body.
  4. Minimize the transmitted payload and redact sensitive names, identifiers, financial details, and control information.
  5. Use short-lived opaque identifiers rather than embedding source data in returned links.
  6. Configure strict server-side retention, access-control, and logging policies for submitted workflow data.
  7. Apply a restrictive Referrer-Policy, such as no-referrer, on the visualization service.
  8. Clearly disclose the destination, fields transmitted, processing purpose, and retention policy before any external transfer.
  9. Provide a safe local-output option, such as Mermaid source or a Markdown table, as the default behavior.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README presents the skill entirely in Chinese and does not indicate that users may interact in other languages or choose their preferred locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill references external network-reachable resources and an MCP/RAG interface but does not declare an explicit tool scope or permissions boundary. That creates an authorization ambiguity where a host agent may allow broader network behavior than users expect, increasing the chance of unintended data disclosure or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level description is broad enough to match ordinary business-model conversations, so the skill may activate outside the intended risk-control context. Over-broad invocation can redirect unrelated conversations into a workflow that solicits business details and potentially encourages external API use unnecessarily.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The title, role definition, trigger descriptions, examples, and required output format are entirely in Chinese, and the file does not indicate that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Skill 1 triggers on a subjective assessment of whether business information is 'complete,' which can vary across agents and conversations. This ambiguity can cause unnecessary questioning and collection of operational details from users who did not clearly request structured risk modeling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The later-stage triggers depend on generic conversational states like 'model not established' or 'user not satisfied,' which are easy to satisfy unintentionally. In practice this can push users through a predetermined funnel, including risk analysis and external-solution steps, without a sufficiently explicit request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs use of an external RAG MCP interface requiring an API key but does not provide strong handling rules for credentials, privacy, storage, or transmission. Users may paste secrets directly into chat or authorize external retrieval without understanding that sensitive business context and credentials could be exposed to third-party systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill directs agents to send business data and an API key to an external MCP endpoint with 'no server-side authentication, pure pass-through,' which creates a real data exfiltration and trust-boundary risk. In an agent skill context, this is more dangerous because the skill operationalizes outbound transmission of potentially sensitive user business information to a third-party service without clear validation, minimization, or governance controls.

Content

Scanner excerpt · references/solution-list.md (reported line 41)May include surrounding context.

1. 列出可用工具：

bash
curl -s -X POST https://mcp.hdconsultatio.com/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest says this skill should be used to assess business risk or find solutions for a business model. However, the implementation only transforms supplied workflow data into a three-flow graph link, a markdown table, and serialized step information; it performs no risk evaluation, anti-cheating detection, or solution generation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code embeds full business process details into a URL pointing to an external domain, which can expose sensitive operational data to a third party through browser requests, logs, referrers, and monitoring systems. In the context of a business-risk analysis skill, users may provide confidential workflows, roles, and control information, making this disclosure significantly more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill returns an external visualization link containing business data without any in-file warning, consent flow, or disclosure that user-supplied process details will leave the local trust boundary. This creates a stealthy data-sharing risk because users may click or consume the link assuming it is an internal artifact, while sensitive business information becomes exposed to the external site and intermediary logging infrastructure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

该文件全部以中文编写，并通过固定中文错误提示和操作说明面向使用者，但没有说明这是仅适用于中文用户的区域性文档，也没有提供其他语言选择。按照语言/locale 政策，若技能说明强制单一语言而无用户选择或合理限定，属于自然语言层面的政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The module docstring and function documentation are entirely in Chinese and provide no indication that another language can be used. Under the policy, forcing a specific language without offering choice or documenting a justified locale restriction is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.