ClawHub
Back to skill

Security audit

BigFocus · 追踪管家（商品价格·明星动态·行业追踪·自定义指标）| Personal Price, Celebrity & Industry Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent tracker, but it needs Review because persistent tracking and scheduled network checks are under-scoped in a few important places.

Review this before installing if you plan to track private interests or paste arbitrary URLs. It should be limited to clearly intended tracker commands, and URL fetching should ideally be restricted to validated public product domains before enabling the hourly cron job.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The add-flow is internally contradictory: one section says confirmation must happen before any write, while a later section describes adding first, then updating/removing after confirmation or cancellation. In an agent setting, this can cause unintended writes to persistent tracking data before the user has approved them, violating the stated safety boundary and enabling accidental or prompt-induced state changes.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger '帮我盯着' is broad everyday language and can fire in normal conversation where the user is not intending to invoke this skill. Because the skill supports write actions, ambiguous activation increases the chance of unintended tracking setup, modification, or disclosure of stored tracking data through accidental invocation.

Vague Triggers

Medium
Confidence
90% confidence
Finding
Several triggers like '我的追踪', '添加追踪', '删除追踪', and '价格追踪' are generic phrases that may overlap with unrelated discussion or other tools. In this skill, ambiguous triggers are more dangerous because the skill has file write, network, web search, and cron-related behavior, so a mistaken activation can lead to persistent changes or scheduled monitoring.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The scan path automatically issues outbound HTTP requests to user-provided targets such as JD product URLs and to third-party APIs without any explicit user-facing disclosure or consent at execution time. This can leak user interest data and can also be abused for server-side request forgery if a crafted target value causes the agent runtime to fetch attacker-chosen internal or sensitive endpoints.

External Transmission

Medium
Category
Data Exfiltration
Content
try:
                # CoinGecko 免费 API
                req = Request(
                    'https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd',
                    headers={'Accept': 'application/json'}
                )
                resp = urlopen(req, timeout=10)
Confidence
80% confidence
Finding
The script transmits data to an external service (CoinGecko) during automatic metric collection. While the transmitted request here is fixed and does not include direct secrets, the undisclosed outbound connection expands the privacy and supply-chain trust surface and may violate least-surprise expectations in an agent skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.