ClawHub
Back to skill

Security audit

Misskey

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Misskey posting tool, but it has unsafe shell execution, a silent default server that can receive tokens and files, and an immediate delete command with weak safeguards.

Review before installing. Use a least-privilege Misskey token, set MISSKEY_HOST explicitly every time, and avoid upload.sh until eval-based command construction is removed. Treat delete.sh as a destructive operation because it deletes immediately without confirmation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/upload.sh:20
Finding

Shell Command Injection Through eval-Based Upload Command Construction

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/post.sh:8
Finding

API Tokens and User Data May Be Sent to an Unintended Hard-Coded Instance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
### 1. Get API Token

1. Login to your Misskey instance
2. Go to **Settings > API > Access Tokens**
3. Create a new token with required permissions

### 2. Configure Environment

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
### 1. Get API Token

1. Login to your Misskey instance
2. Go to **Settings > API > Access Tokens**
3. Create a new token with required permissions

### 2. Configure Environment

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill also exposes a whoami/account introspection capability that is not described in the manifest purpose or triggers. While less severe than deletion, undocumented account-information access undermines transparency and can surprise users by disclosing profile or account metadata beyond the expected posting workflow.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill also exposes a whoami/account introspection capability that is not described in the manifest purpose or triggers. While less severe than deletion, undocumented account-information access undermines transparency and can surprise users by disclosing profile or account metadata beyond the expected posting workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script exposes note deletion functionality even though the declared skill scope only covers posting notes and uploading media. This creates a capability mismatch that can surprise users, bypass expected approval boundaries, and enable destructive actions if the skill is invoked or repurposed in an unintended context.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/post.sh (reported line 62)May include surrounding context.

sh
FIRST=true
    for IMG in "${IMAGES[@]}"; do
        echo "上传图片: $IMG"
        RESPONSE=$(curl -s -X POST "$HOST/api/drive/files/create" \
            -H "Authorization: Bearer $TOKEN" \
            -F "file=@$IMG")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file describes a delete operation via bash scripts/delete.sh "note-id-here" but does not warn the user that it will remove a note or that the action may be irreversible. Under the markdown-specific warning rule, destructive behaviors that can affect user data should be disclosed clearly in the skill description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents shell-based scripts but does not declare any tool scope or allowed-tools boundary in the manifest. That omission weakens reviewability and containment, because an agent may invoke shell capabilities more broadly than users expect when handling networked posting and file-upload actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest does not disclose account-information lookup capability despite documenting a whoami.sh script. Undocumented data-access features can lead to privacy surprises and make security review more difficult, even if the retrieved data is limited to the authenticated user's account details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation tells users to export API tokens and perform posting/upload actions without warning that tokens grant account access and that content and media will be transmitted to external Misskey instances. This raises risk of credential mishandling, shell history exposure, and unintended data disclosure to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation instructs users how to delete notes but provides no warning that the action is destructive, potentially irreversible, or should require confirmation. In a posting skill, that omission makes accidental deletion more likely, especially if an agent acts on ambiguous user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script performs an irreversible delete operation immediately based on a single argument, with no confirmation prompt, dry-run mode, or safety warning. In an agent or automation setting, this increases the chance of accidental or mis-targeted deletion from user error, prompt confusion, or bad input propagation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/delete.sh (reported line 24)May include surrounding context.

sh
NOTE_ID="$1"

echo "删除帖子: $NOTE_ID"
RESULT=$(curl -s -X POST "$HOST/api/notes/delete" \
    -H "Content-Type: application/json" \
    -d "{\"i\": \"$TOKEN\", \"noteId\": \"$NOTE_ID\"}")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's title, usage text, and all user-facing status/error messages are written in Chinese, which imposes a specific language on users without any opt-in or documented locale limitation. This matches the policy category for language/locale violations because the file provides no alternative language selection or justification for being Chinese-only.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/post.sh (reported line 101)May include surrounding context.

sh
# 发帖
echo "发帖中..."
RESULT=$(curl -s -X POST "$HOST/api/notes/create" \
    -H "Content-Type: application/json" \
    -d "$REQUEST")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs an HTTP POST that transmits a user-selected file and an authorization token to a remote server. Although the script prints that an upload is happening, it does not clearly disclose that local file contents and credentials are being sent to the configured host, which is the kind of network/data-transfer warning this rule targets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/whoami.sh (reported line 15)May include surrounding context.

sh
exit 1
fi

RESULT=$(curl -s -X POST "$HOST/api/i" \
    -H "Content-Type: application/json" \
    -d "{\"i\": \"$TOKEN\"}")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The table entry for maid.lat uses Japanese text (メイド情報局) while the rest of the README is in English, with no indication that the skill is region- or language-specific or that users can choose locale. This may conflict with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest does not disclose account-information lookup capability despite documenting a whoami.sh script. Undocumented data-access features can lead to privacy surprises and make security review more difficult, even if the retrieved data is limited to the authenticated user's account details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

Comments and runtime output are written only in Chinese, which imposes a specific language on users without opt-in or explanation. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Comments and runtime messages are entirely in Chinese, and the script provides no language selection or note that it is intentionally region- or locale-specific. For a general-purpose upload utility, this is a natural-language locale policy issue because it imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.