ClawHub
Back to skill

Security audit

Deskpeto

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent desktop-pet purpose, but it asks agents to run remote installer scripts and install an invisible hook-based background runner, which needs user review before installation.

Install only if you trust DeskPeto's service and are comfortable with a remote installer changing AI-tool settings and running an invisible background process. Prefer the manual zip install for static pet assets where possible, avoid pasting reusable tokens into chat or URLs, and review or back up host configuration before allowing hook changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:27
Finding

Unverified Remote Installer Scripts Executed Directly by the Shell

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
SKILL.md:42
Finding

Unaudited Background Runner Modifies AI-Tool Hooks

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/pet-page.html:6
Finding

Remote MCP Values Are Inserted into Executable HTML Without Contextual Escaping

Content
View full analysis
__PET_NAME__ · DeskPeto ``` ```html

__PET_NAME__idle

``` ```html
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:70
Finding

Bearer Token Storage and Query-String Authentication Can Leak Credentials

Content
View full analysis
" } } } } ``` ```text https://mcp.deskpeto.com/mcp?key= ``` An example configuration path documented by the Skill is: ```text ~/.workbuddy/mcp.json ``` ### Technical Analysis Writing an MCP bearer token into host configuration is related to the declared integration, but the Skill does not require owner-only file permissions, encrypted credential storage, redaction, or token revocation controls. The fallback mechanism places the bearer token in the URL query string. Query values can be captured by application logs, reverse proxies, browser history, crash reports, diagnostics, telemetry, screenshots, copied configuration, and referrer propagation. URLs are generally unsuitable for reusable secrets. The manual fallback also asks the user to paste a token into the conversation. That may expose the credential to chat retention, logs, or other systems processing the conversation. ### Attack Path 1. The device flow or manual flow issues an MCP token. 2. The agent writes it to a configuration file without enforcing restrictive permissions, or embeds it in the MCP URL. 3. Another local user, process, backup, log collector, proxy, telemetry system, or conversation-retention system obtains the token. 4. The attacker sends authenticated requests to the DeskPeto MCP endpoint. 5. The attacker accesses operations and data authorized to the stolen token until it expires or is revoked. ### Impact Assessment The attacker obtains the account capabilities granted to the MCP token. The Skill states that authenticated access is required for personal pets and installation commands, so compromise may expose private pe ...[truncated 275 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This duplicate finding captures the same unsafe shell-piping behavior for the pet installer. The surrounding context makes it more dangerous because the skill normalizes the practice as 'recommended' and says the user may hand the command to the agent for direct execution, reducing opportunities for human review.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
4. **等待成品**：动作图集与质检完成后，宠物页提供下载与安装入口。
5. **安装**（三选一）：
   - **一键命令（推荐）**：宠物页上有现成命令，用户复制给你后可直接代为执行：
     - macOS/Linux：`curl -fsSL 'https://api.deskpeto.com/v1/install/…?t=…' | sh`
     - Windows PowerShell：`irm 'https://api.deskpeto.com/v1/install/….ps1?t=…' | iex`
     - 命令把 `pet.json` 与 `spritesheet.webp` 装进 `~/.codex/pets/<宠物目录>/`。**命令 1 小时过期**，过期让用户回宠物页重新复制。
   - **手动**：下载 zip → 解压 → 整个文件夹放入 `~/.codex/pets/`（Windows：`%USERPROFILE%\.codex\pets\`）。

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This duplicate finding captures the same unsafe shell-piping behavior for the pet installer. The surrounding context makes it more dangerous because the skill normalizes the practice as 'recommended' and says the user may hand the command to the agent for direct execution, reducing opportunities for human review.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
4. **等待成品**:动作图集与质检完成后,宠物页提供下载与安装入口。
5. **安装**(三选一):
   - **一键命令(推荐)**:宠物页上有现成命令,用户复制给你后可直接代为执行:
     - macOS/Linux:`curl -fsSL 'https://api.deskpeto.com/v1/install/...?t=...' | sh`
     - Windows PowerShell:`irm 'https://api.deskpeto.com/v1/install/....ps1?t=...' | iex`
     - 命令把 `pet.json` 与 `spritesheet.webp` 装进 `~/.codex/pets/<宠物目录>/`。**命令 1 小时过期**,过期让用户回宠物页重新复制。
   - **手动**:下载 zip → 解压 → 整个文件夹放入 `~/.codex/pets/`(Windows:`%USERPROFILE%\.codex\pets\`)。

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This is the most dangerous finding because the fetched script not only executes arbitrary code but also installs a background runner, modifies settings.json, and hooks into AI desktop tools. If the remote installer is malicious or compromised, it can establish persistence, tamper with host tooling, and potentially observe or influence future agent activity on the desktop.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
**安装前先向用户说明并征得同意再执行**（这条命令会下载并运行一个程序、并修改 AI 工具的 `settings.json`）：

- macOS / Linux：`curl -fsSL https://api.deskpeto.com/v1/runner/install | sh`
- Windows PowerShell：`irm https://api.deskpeto.com/v1/runner/install.ps1 | iex`

命令做三件事：把对应平台的 runner 下到 `~/.deskpeto/bin/` → 自动接线 hooks → 启动。装好后让用户**完全退出并重开** AI 工具（多数宿主仅启动时加载 hooks），桌宠即随任务切换动作（工作中 / 等待输入 / 完成 / 失败）。

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This line instructs the agent to retrieve installation content from an external service and execute the resulting install flow on the user's machine. Even though the stated purpose is legitimate, fetching installer content from a remote endpoint introduces a trust boundary where compromised infrastructure, token leakage, or malicious server responses could lead to unintended code or file delivery.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
4. **等待成品**：动作图集与质检完成后，宠物页提供下载与安装入口。
5. **安装**（三选一）：
   - **一键命令（推荐）**：宠物页上有现成命令，用户复制给你后可直接代为执行：
     - macOS/Linux：`curl -fsSL 'https://api.deskpeto.com/v1/install/…?t=…' | sh`
     - Windows PowerShell：`irm 'https://api.deskpeto.com/v1/install/….ps1?t=…' | iex`
     - 命令把 `pet.json` 与 `spritesheet.webp` 装进 `~/.codex/pets/<宠物目录>/`。**命令 1 小时过期**，过期让用户回宠物页重新复制。
   - **手动**：下载 zip → 解压 → 整个文件夹放入 `~/.codex/pets/`（Windows：`%USERPROFILE%\.codex\pets\`）。

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The Windows variant similarly depends on downloading installation content from a remote DeskPeto endpoint and executing it locally. Any compromise of the endpoint, transport assumptions, or install token handling could expose the user to malicious payload delivery or unauthorized modification of local files.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
5. **安装**（三选一）：
   - **一键命令（推荐）**：宠物页上有现成命令，用户复制给你后可直接代为执行：
     - macOS/Linux：`curl -fsSL 'https://api.deskpeto.com/v1/install/…?t=…' | sh`
     - Windows PowerShell：`irm 'https://api.deskpeto.com/v1/install/….ps1?t=…' | iex`
     - 命令把 `pet.json` 与 `spritesheet.webp` 装进 `~/.codex/pets/<宠物目录>/`。**命令 1 小时过期**，过期让用户回宠物页重新复制。
   - **手动**：下载 zip → 解压 → 整个文件夹放入 `~/.codex/pets/`（Windows：`%USERPROFILE%\.codex\pets\`）。
   - **其他 AI 工具**：经开源 Runner「clawd-on-desk」导入同一个 zip，可在 Claude Code、CodeBuddy 等多种工具旁显示（第三方项目，以其自身文档为准）。

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This runner installation flow downloads and runs a program from an external endpoint, then modifies local AI tool configuration and starts a background process. In this context the skill is not merely linking to a site; it is encouraging privileged system changes and persistent execution, which materially increases the risk if the remote endpoint or script is ever abused.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
**安装前先向用户说明并征得同意再执行**（这条命令会下载并运行一个程序、并修改 AI 工具的 `settings.json`）：

- macOS / Linux：`curl -fsSL https://api.deskpeto.com/v1/runner/install | sh`
- Windows PowerShell：`irm https://api.deskpeto.com/v1/runner/install.ps1 | iex`

命令做三件事：把对应平台的 runner 下到 `~/.deskpeto/bin/` → 自动接线 hooks → 启动。装好后让用户**完全退出并重开** AI 工具（多数宿主仅启动时加载 hooks），桌宠即随任务切换动作（工作中 / 等待输入 / 完成 / 失败）。

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The PowerShell variant performs the same risky pattern on Windows by fetching remote code and executing it while altering settings and launching a resident runner. Because it establishes persistence-like behavior and hook integration, exploitation could lead to ongoing unauthorized monitoring or code execution under the user's account.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
**安装前先向用户说明并征得同意再执行**（这条命令会下载并运行一个程序、并修改 AI 工具的 `settings.json`）：

- macOS / Linux：`curl -fsSL https://api.deskpeto.com/v1/runner/install | sh`
- Windows PowerShell：`irm https://api.deskpeto.com/v1/runner/install.ps1 | iex`

命令做三件事：把对应平台的 runner 下到 `~/.deskpeto/bin/` → 自动接线 hooks → 启动。装好后让用户**完全退出并重开** AI 工具（多数宿主仅启动时加载 hooks），桌宠即随任务切换动作（工作中 / 等待输入 / 完成 / 失败）。

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The invocation description says to use the skill when the user says several Chinese trigger phrases, with only the English product description appended afterward. This creates a language-specific activation policy without stating that other languages are equally supported or that the Chinese-only trigger list is merely illustrative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The HTML root sets lang="zh-CN", and the visible UI text throughout the page is also fixed in Simplified Chinese. For this file type, policy review should flag language constraints when the skill does not provide user opt-in or explain why a single locale is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.