ClawHub
Back to skill

Security audit

ima_skills_yc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent IMA note-management integration, but it asks for broad private-note read/write authority with loose activation rules and persistent plaintext credential guidance.

Install only if you intend to let the agent access and modify your Tencent IMA notes. Avoid putting the API key directly in shell startup files; use a dedicated secrets mechanism if possible. Treat ambiguous requests like “remember this” or “find what I wrote before” carefully, and require confirmation before the agent reads full note content, imports a file, creates a note, or appends to an existing note.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:30
Finding

Persistent Plaintext Storage of IMA API Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger description is overly broad and matches common phrases such as '帮我记一下' or references to 'something I wrote before,' which can cause the skill to activate for many ordinary conversations. In an agent setting, this overreach is dangerous because it may cause unnecessary access to private note data or unintended writes to a user's personal knowledge base without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill’s natural-language instructions and examples are entirely framed in Chinese and direct invocation behavior based on Chinese user phrasing, but do not state that the skill is intentionally limited to Chinese users or offer any language choice. This can amount to a language/locale policy issue because the skill appears to assume a fixed language without user opt-in or justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

bash
ima_api() {
  local endpoint="$1" body="$2"
  curl -s -X POST "https://ima.qq.com/openapi/note/v1/$endpoint" \
    -H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
    -H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
    -H "Content-Type: application/json" \

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill includes guidance to read arbitrary local files and invoke external runtimes/tools (Python, Node.js, iconv, PowerShell) to ingest content before sending it to the notes API. That expands the skill from simple note management into local file processing and increases the chance of unintended sensitive-file access or exfiltration if an agent applies these instructions broadly to satisfy a user request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level description activates on many generic phrases, including indirect expressions like “帮我记一下” and broadly defined personal document access, without explicit scope boundaries or confirmation requirements. Because this skill can read and modify private notes, overly permissive activation materially raises the risk of unauthorized or accidental operations on sensitive user data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger guidance uses broad phrases such as “搜索” and “找笔记”, which can match common conversational intents without sufficiently constraining that the request is specifically about the user’s IMA notes. This increases the chance of unintended skill invocation and accidental access to private note metadata or content when another tool or a non-note response would have been more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The create and append API documentation describes state-changing operations but does not clearly warn that these actions persistently modify stored user data. In an agent setting, missing write-safety guidance can cause silent or accidental note creation/editing from casual user phrasing, leading to integrity issues and unintended storage of sensitive content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.