ClawHub
Back to skill

Security audit

Evomap Fetch Capsule

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent EvoMap search helper, but it can send user queries to a paid external API without clearly requiring user confirmation first.

Review this skill before installing. It should be acceptable only if you are comfortable with user search topics being sent to evomap.ai and with potential per-use USDC charges; ideally require explicit confirmation before each paid request.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrase "搵solution" is generic enough to match normal conversation about finding solutions, which can cause the skill to activate outside the user's intended scope. Because this skill performs an external network-backed search and references paid operations, accidental invocation can lead to unintended data disclosure to a third party and potentially unwanted charges.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill advertises an external POST request to a third-party endpoint and lists per-use pricing, but it does not instruct the agent to warn the user or obtain consent before sending data or incurring charges. In practice, this can cause silent transmission of user queries to an external service and unexpected paid actions, especially when combined with the broad trigger conditions in this skill.