ClawHub
Back to skill

Security audit

Deskpeto

Security checks for vulnerabilities and agentic risk

Overview

The skill’s desktop-pet purpose is coherent, but it asks the agent to run remote installers, add background hooks, and handle access tokens, so users should review it carefully before installing.

Install only if you trust DeskPeto and are comfortable with an agent running remote installer commands, changing AI tool settings, installing an invisible background runner, and storing DeskPeto tokens in local MCP configuration. Prefer the manual zip install for pet assets, avoid pasting tokens into chat, and review or remove hooks if you no longer use the runner.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill directs the agent to write authentication tokens into local MCP configuration files, which expands its scope from simple guidance into privileged credential handling and local configuration modification. This is dangerous because bearer tokens can grant access to the user's DeskPeto account and modifying host config files can unintentionally expose secrets, persist access, or affect unrelated tooling if done incorrectly.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to install a background runner, modify third-party AI tool settings, and add hooks that persist on the user's machine. Even with user consent language, this is risky because it authorizes arbitrary system changes and persistent execution based on remotely delivered installer logic.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The manual-token fallback tells the user to paste an access token back into chat, treating a credential like ordinary text. This is dangerous because chat transcripts may be logged, retained, or visible to other systems, allowing token theft and account misuse.

External Script Fetching

High
Category
Supply Chain
Content
4. **等待成品**：动作图集与质检完成后，宠物页提供下载与安装入口。
5. **安装**（三选一）：
   - **一键命令（推荐）**：宠物页上有现成命令，用户复制给你后可直接代为执行：
     - macOS/Linux：`curl -fsSL 'https://api.deskpeto.com/v1/install/…?t=…' | sh`
     - Windows PowerShell：`irm 'https://api.deskpeto.com/v1/install/….ps1?t=…' | iex`
     - 命令把 `pet.json` 与 `spritesheet.webp` 装进 `~/.codex/pets/<宠物目录>/`。**命令 1 小时过期**，过期让用户回宠物页重新复制。
   - **手动**：下载 zip → 解压 → 整个文件夹放入 `~/.codex/pets/`（Windows：`%USERPROFILE%\.codex\pets\`）。
Confidence
98% confidence
Finding
The skill recommends `curl ... | sh` / `irm ... | iex` using a time-limited URL from a remote service and says the agent may execute it on the user's behalf. This is dangerous because it bypasses review of the downloaded script, gives the remote server immediate code execution on the host, and normalizes a high-risk install pattern even if the intended payload is only pet assets.

External Script Fetching

High
Category
Supply Chain
Content
**安装前先向用户说明并征得同意再执行**（这条命令会下载并运行一个程序、并修改 AI 工具的 `settings.json`）：

- macOS / Linux：`curl -fsSL https://api.deskpeto.com/v1/runner/install | sh`
- Windows PowerShell：`irm https://api.deskpeto.com/v1/runner/install.ps1 | iex`

命令做三件事：把对应平台的 runner 下到 `~/.deskpeto/bin/` → 自动接线 hooks → 启动。装好后让用户**完全退出并重开** AI 工具（多数宿主仅启动时加载 hooks），桌宠即随任务切换动作（工作中 / 等待输入 / 完成 / 失败）。
Confidence
99% confidence
Finding
The runner installation uses `curl ... | sh` / `irm ... | iex` to download and immediately execute a program that installs a background component, modifies AI tool settings, and adds hooks. In context this is more dangerous than a simple asset install because it creates persistence and changes third-party application behavior, so a compromised endpoint or abusive update could lead to full user-level code execution and long-lived system impact.

Static analysis

No suspicious patterns detected.