ClawHub
Back to skill

Security audit

douban-monitor

Security checks for vulnerabilities and agentic risk

Overview

This media-monitoring skill is coherent and disclosed, but users should notice that its default mode can commit and push generated data to the configured Git remote.

Install only in a repository where automatic commits and pushes of generated media-monitoring data are acceptable. For local-only use, set auto_git_push = false or run with DOUBAN_MONITOR_NO_PUSH=1, and only configure TMDB credentials if you are comfortable sending media lookup queries to TMDB.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if not script_path.exists():
            continue
        log_kv("运行", script_name)
        result = subprocess.run(
            [python, str(script_path)],
            cwd=str(project_root),
            capture_output=True, text=True,
Confidence
78% confidence
Finding
The script automatically executes other Python files from the repository directory if they exist, creating a trust boundary issue: any modified or newly introduced helper script in that location will be run with the monitor's privileges. In a skill or automation context, this increases the blast radius of repository compromise or malicious file placement into arbitrary code execution during routine runs.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README states that step 8 will automatically commit and push generated content to GitHub, but it does not present this as a prominent warning about repository modification and publication. In a skill context, automatic publishing can leak generated data, overwrite repository state, or surprise operators who expect a read-only/reporting tool.

Missing User Warnings

Low
Confidence
79% confidence
Finding
The README instructs users to configure TMDB credentials and describes TMDB as a metadata source, but it does not clearly warn that the skill sends queries and title-related data to a third-party service. While this project appears to process public media metadata rather than obviously sensitive user content, the missing disclosure creates a privacy/transparency gap for operators.

Static analysis

No suspicious patterns detected.