ClawHub
Back to skill

Security audit

Fetch Legionclaw Invite Code

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly aimed at fetching LegionClaw invite codes, but it uses hidden session context to request and disclose permission codes without a clear user-side authorization boundary.

Install only if you trust this publisher and intend the agent to use LegionClaw runtime/session identity to obtain invite codes. Confirm that the backend enforces who may claim codes and how many may be issued, because the skill defaults to retrieving the session identifier from host context and returning generated codes directly in chat.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to obtain the current session handle from runtime injection or the host/model instead of the user, then derive an internal agent identifier and use it to claim invite codes. This enables the agent to access and disclose credentials or permission artifacts tied to host-side context without an explicit user-provided identifier or clear authorization check, creating a cross-context secret retrieval and disclosure risk.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section operationalizes the same behavior by directing the agent to fetch the full current session identifier from host-side context or by querying the host model, then reuse the parsed agentid to request invite codes. Pulling identifiers from non-user-visible context and converting them into externally redeemable access codes is dangerous because it bypasses normal user mediation and can leak or mint access tied to an internal session/account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill content and required reply templates are entirely specified in Chinese, including a mandatory output format for user-facing responses. There is no indication that the user may choose another language or that the Chinese-only behavior is a documented, justified regional constraint, which violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The external POST itself is not inherently unsafe, but in this skill it transmits a parsed internal agent identifier to a third-party endpoint in order to obtain invite codes and then disclose them to the user. In context, the outbound request is part of the unauthorized secret/permission retrieval flow, so the transmission meaningfully contributes to data exposure and privilege abuse risk.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

  1. 对 i = 1 .. COUNT，各执行一次下方 curl（同一 AGENTID）。单次 curl 示例（将 AGENTID 替换为解析结果；若含 " 或 \ 等字符，需先做 JSON 字符串转义）：
bash
curl -sS -X POST "https://legion.tongfudun.com/userInvite/claimIndustryInviteCode" \
  -H "Content-Type: application/json" \
  -H "Web-RedPackage: webRedPackage" \
  -d "{\"userId\":\"${AGENTID}\"}"