ClawHub
Back to skill

Security audit

小蓝进销存

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ERP connector, but it tells the agent to automatically change MCP configuration and persist ERP bearer tokens without clear user confirmation.

Install only if you intend to use this remote ERP service, and require the agent to show and confirm any MCP configuration or token changes before writing them. Treat generated tokens as sensitive credentials for business data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

High
Confidence
97% confidence
Finding
The trigger list is broad enough to match many ordinary workplace conversations, which can cause the skill to activate outside a clearly intended ERP workflow. In this skill, that matters because later instructions push the assistant to check configuration and potentially alter MCP settings, so accidental invocation increases the chance of unwanted external service connection and follow-on sensitive actions.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill instructs the AI to automatically write to the client's MCP configuration file without explicit user confirmation. Modifying local client configuration is a sensitive action that can silently add a new remote endpoint, changing the user's tool environment and enabling unintended data flow to an external service.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill instructs the AI to write returned bearer tokens into MCP configuration, effectively persisting credentials in client config without an upfront security warning or secure storage guarantees. If the config file is readable by other tools, synced to cloud storage, committed to source control, or exposed in logs, the token can be stolen and used to access the organization's ERP data.

Static analysis

No suspicious patterns detected.