ClawHub
Back to skill

Security audit

运营商三要素核验 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles highly sensitive identity data and under-discloses ways that data can be exposed.

Review carefully before installing. Use only for cases where the user explicitly wants Juhe telecom real-name verification, warn them that their identity data will be sent to Juhe, avoid passing API keys or identity values on the command line, and do not run the current script where stdout is logged unless the raw JSON output is removed or sanitized.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/telecom_verify.py:251
Finding

Unmasked Identity Data Is Written to Standard Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/telecom_verify.py:191
Finding

API Credentials and Identity Data Are Accepted and Recommended Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The AI usage guidance instructs the agent to collect a phone number, real name, and national ID number and then call a third-party API, but it does not present a clear privacy warning or obtain explicit consent before transmission. Because these are highly sensitive identity attributes, silent collection and external transfer materially increases privacy, compliance, and identity-theft risk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python telecom_verify.py --key your_api_key ...
    2. 环境变量：export JUHE_TELECOM_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_TELECOM_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/208
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python telecom_verify.py --key your_api_key ...
    2. 环境变量：export JUHE_TELECOM_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_TELECOM_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/208
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/telecom_verify.py (reported line 13)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python telecom_verify.py --key your_api_key ...
    2. 环境变量：export JUHE_TELECOM_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_TELECOM_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/208
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/telecom_verify.py (reported line 245)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python telecom_verify.py --key your_api_key ...
    2. 环境变量：export JUHE_TELECOM_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_TELECOM_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/208
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/telecom_verify.py (reported line 39)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises executable behavior that uses environment variables, local file access, and outbound network calls, but it does not declare any explicit tool scope or permissions boundary. That increases the chance an agent invokes the skill without clear user/admin awareness of its capability to read secrets and transmit sensitive data externally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description includes broad triggers like '实名认证' and related phrases that may cause the skill to activate on loosely related requests. In a skill that handles name, ID card number, and mobile number, over-broad activation raises the risk of collecting and sending highly sensitive PII when the user did not clearly intend to invoke this exact external verification workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script sends highly sensitive PII including real name, mobile number, and optionally a national ID number to a third-party API service. Although this is the intended function of the skill, there is no explicit privacy warning, consent prompt, minimization guidance, or retention/transmission notice, which creates a real privacy and compliance risk if users or integrators are unaware of the data-sharing implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

All user-facing instructions, help text, and outputs are hard-coded in Chinese, which forces a specific language/locale on users. The policy allows locale constraints when they are clearly documented and justified or when users are given a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.