ClawHub
Back to skill

Security audit

Clip2MD

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it stores a clip2md access token locally without restrictive permissions and can be invoked broadly enough to submit URLs to an external service unintentionally.

Install only if you are comfortable giving this skill a clip2md token and letting it send selected URLs to clip2.md. After configuring it, check permissions on ~/.clip2md/config.json, avoid using it on shared machines, and rotate or remove the token if you no longer use the skill. Be careful with generic requests to 'clip' or save pages because this skill may be selected implicitly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill explicitly instructs the agent to run a Node CLI, read configuration from the user's home directory, and call a remote API, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may underestimate the skill's access to local environment data and network operations, increasing the chance of unintended credential handling or external data transfer.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger list includes very broad terms such as 'clip' and generic task phrases, which can cause accidental activation in unrelated conversations. Unintended activation is security-relevant here because the skill can prompt for tokens, inspect local config, and submit user-provided URLs to an external service, potentially causing data exposure or confusing the user into authorizing unnecessary actions.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default prompt uses a broad, action-oriented invocation phrase ('save this web page as a Markdown clipping and report the task status') that can match ordinary user requests about saving or converting web content. Combined with allow_implicit_invocation=true, this increases the chance the skill is triggered without sufficiently explicit user intent, causing unintended submission of URLs or content to the external clip2md service.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script persists the API token to ~/.clip2md/config.json without setting restrictive file permissions or warning the user that a long-lived credential is being stored on disk. On multi-user systems, shared environments, backups, or compromised local accounts, this increases the chance of token disclosure and subsequent unauthorized use of the clip2md account/API quota.

Credential Access

High
Category
Privilege Escalation
Content
---
name: clip2md
description: Use clip2md to configure an access token, save web pages or article URLs as Markdown clipping tasks, check remaining daily/permanent quota, query task status, and wait for clipping completion or failure. Use when the user mentions clip2md, 剪藏, clip, 保存网页为 Markdown, 查询额度, 提交链接, 查询任务, 等待剪藏完成, or wants an Agent to operate the clip2md product tool.
metadata:
  openclaw:
    requires:
Confidence
88% confidence
Finding
The skill is designed to collect and configure an access token, which is inherently sensitive credential material. Although the instructions say not to echo the token, the skill still handles credentials and stores them in a user-home config path, so compromise, accidental disclosure, or insecure storage could grant unauthorized access to the clip2md account or API quota.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/smoke-test.js:108