ClawHub
Back to skill

Security audit

Sa Master

Security checks across malware telemetry and agentic risk

Overview

This skill is an architecture-document assistant, but it sends potentially sensitive project materials to an external MCP service using an embedded bearer token and limited user-facing disclosure.

Review this carefully before installing. Use it only if you are comfortable sending architecture documents, requirements, API details, and deployment information to the listed external MCP service. The publisher should rotate the exposed token, remove secrets from the package, restrict allowed tool calls, and add an explicit consent and data-handling notice before this should be treated as low risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill is presented as a narrow architecture-document assistant, but its documented behavior depends on generic remote MCP invocation with authenticated outbound requests and pass-through of arbitrary tool names, messages, context, and session identifiers. That mismatch is dangerous because users may share sensitive project artifacts believing they stay within a bounded documentation workflow, while the skill can transmit them to a remote service with broader execution semantics.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill embeds a hardcoded bearer token directly in the documentation for connecting to a remote MCP service. Exposed credentials can be harvested by anyone with access to the skill file, enabling unauthorized use of the service, impersonation, billing abuse, or access to downstream data handled by that MCP endpoint.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest describes a document-generation skill, but the operational instructions require outbound connection to an external MCP service and remote tool/knowledge execution. This hidden dependency expands the trust boundary and creates unanticipated confidentiality and supply-chain risk, especially when users provide internal architecture documents, APIs, and deployment details.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The script implements a generic remote MCP proxy that accepts arbitrary tool names and forwards user-controlled message, context, and conversation state to a configured remote endpoint with an optional bearer token. That capability is broader than the declared architecture-document skill scope, creating unnecessary exposure to data exfiltration, unauthorized remote actions, or expansion into tools the user did not intend to invoke.

Vague Triggers

Medium
Confidence
75% confidence
Finding
The trigger keyword lists are broad enough that normal conversation about architecture, APIs, deployment, or reviews could unintentionally invoke remote tools. In this skill, that matters more because invocation may lead to authenticated outbound requests and transmission of sensitive project context to the MCP service without a strong confirmation boundary.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill instructs the client agent to connect to a remote MCP service and process user-provided project materials, but it does not warn users that their data may be transmitted externally. Given the skill’s domain, that data can include proprietary architecture, interface definitions, deployment topology, and review materials, making the omission a meaningful confidentiality risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script transmits the user message, context JSON, and conversation ID to a remote server via curl without any runtime notice, consent gate, or data minimization. In a skill that may process BA/business-asset content and architecture materials, this can expose sensitive internal business or system-design information to an external service unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/bin/bash
# ─────────────────────────────────────────────────────────────────────────────────
# MCP Tool 通讯脚本 — bash + curl + python3（零外部依赖）
#
# 用法:
#   bash call_tool.sh <tool_name> "<message>" ['<context_json>'] [conversation_id]
Confidence
88% confidence
Finding
The script is explicitly designed to send content to an external endpoint using curl, and that includes user-supplied messages and contextual data. In the context of a system-architecture skill, those inputs are likely to contain sensitive business requirements, internal topology, or implementation details, so external transmission increases confidentiality risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:84