ClawHub
Back to skill

Security audit

中国农历黄历吉凶查询 · Chinese Almanac, Lunar Calendar & Auspicious Days

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Huangli/lunar-calendar API skill with sensitive authentication behavior that users should understand before use, but the artifacts do not show deception or unrelated access.

Install only if you are comfortable sending calendar query dates and Huangli account credentials or tokens to the nongli.skill.4glz.com service. Use a unique password for this service, keep HUANGLI_BASE set to the official API host unless you are testing deliberately, and treat HUANGLI_TOKEN like a password.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 50, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
data = json.dumps(payload).encode("utf-8")
        headers["Content-Type"] = "application/json"
    req = urllib.request.Request(url, method=method, data=data, headers=headers)
    with urllib.request.urlopen(req) as resp:
        return json.loads(resp.read())
Confidence
87% confidence
Finding
The request target is derived in part from the HUANGLI_BASE environment variable and then used directly in urllib.request.urlopen with an Authorization bearer token attached. If an attacker can influence that environment variable, they can redirect requests to an attacker-controlled host and capture the token or proxy sensitive responses, creating an SSRF-style exfiltration path.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented primarily as a calendar/almanac lookup tool, but the documentation also enables account registration, login, device authorization, and agent-mode token acquisition. That is a meaningful behavioral expansion because it introduces credential handling and token issuance flows not clearly disclosed in the core purpose, increasing the chance that users or agents provide sensitive credentials unexpectedly to a third-party service.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
The metadata states HUANGLI_TOKEN is required, which implies token-based usage, but the documentation later describes autonomous username/password registration and login. This inconsistency can mislead users and downstream agents about what secrets may be requested or transmitted, creating avoidable credential exposure risk.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script adds account registration, login, token issuance, and browser-based/device authorization capabilities that are not reflected in the skill’s stated Huangli/calendar functionality. Hidden or under-disclosed authentication flows expand the trust boundary, create an external dependency on a remote service, and may cause users or agents to submit credentials to infrastructure they did not expect from a calendar utility.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger phrases are broad and include common-language queries like '这一天好不好' and '今天黄历怎么样', which can cause the skill to activate in unrelated conversational contexts. Over-broad invocation increases the chance of unintended external API calls and unintended disclosure of user queries to the remote service.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation does not prominently warn that user queries are sent to an external API and that credentials may be used for automatic login flows. Lack of transparent disclosure undermines informed consent and can lead users or agents to submit sensitive data under the assumption the skill is purely local or token-only.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.