ClawHub
Back to skill

Security audit

MC Ecosystem Adaptation Engineer

Security checks for vulnerabilities and agentic risk

Overview

This Minecraft tool needs review because its save-sync and repacking features lack important limits, generated reports can contain injected scripts, and offline settings do not prevent all network requests.

Prefer a corrected release before using this with valuable saves or private folders. For evaluation, use disposable game copies and separate backups, trust everyone who can modify the sync folder, and inspect replacement resources and proposed mod versions. Do not rely on --offline to block networking, and leave the local API disabled unless needed. The evidence supports security flaws and incomplete controls, not intentional malware.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
core/save_sync.py
Finding

Cloud-synchronized configuration controls trusted local read and write destinations

Content
View full analysis

Impact

For backup, setting saves_dir to a parent containing sensitive subdirectories causes their files to be packaged into the cloud-synchronized output. For restore, selecting a sensitive local directory and providing ordinary relative archive members permits overwriting files there with the user's permissions. No archive traversal syntax is necessary.

T09 · Insecure Skill Coding Practices

Warning
Location
core/mixin_scanner.py
Finding

Unescaped third-party Mixin metadata becomes executable report HTML

Content
View full analysis

Impact

HTML elements and event handlers embedded in the metadata execute in the report's browser context. They can alter displayed findings and make outbound requests carrying report-visible information. This does not establish arbitrary local filesystem access or native code execution.

other

Warning
Location
core/i18n.py
Finding

Import-time IP geolocation bypasses offline and explicit-language options

Content
View full analysis

Impact

The contacted provider observes the connection's public egress IP and Skill-specific User-Agent and can associate the invocation with geographic information. The first endpoint uses plaintext HTTP. This path does not send license keys, machine IDs, save files, or conversation contents.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (53)

Tainted flow: 'req' from os.environ.get (line 771, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · core/auth_manager.py (reported line 781)May include surrounding context.

python
method="POST",
        )

        with urlopen(req, timeout=AUTH_SERVER_TIMEOUT) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            return result

Tainted flow: 'req' from os.environ.get (line 837, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · core/auth_manager.py (reported line 850)May include surrounding context.

python
method="POST",
    )
    
    with urlopen(req, timeout=AUTH_SERVER_TIMEOUT) as resp:
        return json.loads(resp.read().decode("utf-8"))

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
icon: assets/icon-market.jpg

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
icon_local: assets/icon-local.jpg

The documented machine-ID and server-signature verification is not implemented.

High
Category
Excessive Agency
Confidence
99% confidence
Finding

The client generates and submits a machine ID, but it never verifies a server signature or binds cached authorization to that machine ID; the machine_id argument to _check_offline is unused. A user able to modify the unsigned cache can fabricate membership when the server is unavailable, and responses from the localhost HTTP service are trusted without application-level authentication. In this licensing context, the demonstrated impact is entitlement bypass rather than arbitrary code execution.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · core/payment_page.py (reported line 83)May include surrounding context.

python
y": _PAYMENT_ASSETS / "unionpay_qr.png",
    "digital": _PAYMENT_ASSETS / "digital_yuan_qr.png",
    "douyin": _PAYMENT_ASSETS / "douyin_pay_qr.png",
}

# === 主支付渠道配置 ===
_PRI_PAYMENT_CHANNELS = {
    "wechat_pay": {
        "name": "微信支付",
        "name_en": "WeChat Pay",
        "icon": "💬",
        "color": "#07C160",
        "bg_color": "#e8f5e9",
        "description": "请打开微信 APP 扫码付款",
        "description_en": "Open WeChat App to scan QR code",
    },
    "alipay": {
        "name": "支付宝",
        "name_en": "Alipay",
        "icon": "💙",
        "color": "#1677FF",
        "bg_color": "#e3f2fd",
        "description": "请打开支付宝 APP 扫码付款",
        "description_en": "Open Alipay App to scan QR code",
    },
    "paypal": {
        "name": "PayPal/外币",
        "name_en": "PayPal / Foreign Currency",
        "icon": "🌍",
        "color": "#003087",
        "bg_color": "#e3f2fd

The resource-only guarantee is contradicted by unrestricted replacement of JAR entries, including compiled code.

High
Category
Excessive Agency
Confidence
99% confidence
Finding

The resource-only restriction is not enforced: SUPPORTED_RESOURCE_EXTS is unused, build_resource_mapping includes every file, and validate_resource_file accepts unknown extensions, allowing replace_resources to add or overwrite .class files and JAR loading metadata even when validation is enabled. An attacker controlling the replacement resource directory could therefore inject executable code into the output JAR, which may execute with the user's privileges when loaded. This is especially dangerous because the tool presents itself as resource-only and explicitly encourages installing the resulting JAR.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · locales/en_us.json (reported line 398)May include surrounding context.

json
"warning.experimental": "This is an experimental feature",
  "warning.config_recommended": "Using config file is recommended for batch operations",
  "prompt.confirm_continue": "Continue?",
  "prompt.confirm_overwrite": "Overwrite existing files?",
  "prompt.confirm_delete": "Delete selected items?",
  "prompt.confirm_exit": "Exit without saving?",
  "prompt.input_required": "Input is required",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.py (reported line 32)May include surrounding context.

python
class APIConfig:
    """API相关配置"""
    # Modrinth API (无需认证，但有速率限制 300次/分钟)
    MODRINTH_BASE = "https://api.modrinth.com/v2"
    MODRINTH_USER_AGENT = "MC-Skill-V1/1.0 (https://github.com/mc-skill)"
    MODRINTH_RATE_LIMIT = 300  # 每分钟最大请求数

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · core/modrinth_client.py (reported line 27)May include surrounding context.

python
logger = logging.getLogger(__name__)

# Modrinth API 基础 URL
MODRINTH_API = "https://api.modrinth.com/v2"

# 加载器名称映射（内部名称 -> Modrinth 名称）
LOADER_MAP = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.py (reported line 37)May include surrounding context.

python
MODRINTH_RATE_LIMIT = 300  # 每分钟最大请求数

    # CurseForge API (需要API Key)
    CURSEFORGE_BASE = "https://api.curseforge.com/v1"
    CURSEFORGE_GAME_ID = 432  # Minecraft的gameId
    CURSEFORGE_CLASS_MOD = 6  # Mod分类

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · core/auth_client.py (reported line 135)May include surrounding context.

python
# 1. 尝试在线查询
    try:
        resp = requests.post(
            f"{SERVER_URL}/api/auth/quick-check",
            json={"machine_id": machine_id},
            timeout=5

Offline authorization can outlast the documented one-hour maximum.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The in-memory offline path checks only token_expires_at, which is derived from the server-provided token_expires_in without enforcing OFFLINE_CACHE_TTL. Consequently, a token lifetime longer than one hour allows offline authorization beyond the documented maximum; future-dated cache timestamps also pass the cache age checks. This can extend paid access or delay effective revocation during an outage.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · core/auth_manager.py (reported line 365)May include surrounding context.

python
import subprocess
            import sys
            if sys.platform == "win32":
                subprocess.run("clip", input=machine_id, capture_output=True, text=True)
                print("  ✅ 机器码已自动复制到剪贴板\n")
        except Exception:
            print("  💡 请手动复制上面的机器码\n")

Tainted flow: 'machine_id' from os.environ.get (line 345, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · core/auth_manager.py (reported line 365)May include surrounding context.

python
import subprocess
            import sys
            if sys.platform == "win32":
                subprocess.run("clip", input=machine_id, capture_output=True, text=True)
                print("  ✅ 机器码已自动复制到剪贴板\n")
        except Exception:
            print("  💡 请手动复制上面的机器码\n")

disable_payment() claims to disable payment restrictions globally, but only changes the payment-prompt flag; usage restrictions remain enforced.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The docstring at L1185 explicitly promises to disable payment restrictions globally. However, setting ENABLE_PAYMENT=False does not disable the post-trial quota checks at L0537–L0545; it only changes the upgrade messaging, so callers relying on this function to remove restrictions will still have usage denied.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · core/auto_fix.py (reported line 135)May include surrounding context.

python
mods_dir: str,
    version_recommendations: List[Dict[str, Any]],
    backup_dir: Optional[str] = None,
    auto_confirm: bool = False,
) -> AutoFixResult:
    """执行模组自动修复

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · core/auto_fix.py (reported line 175)May include surrounding context.

python
logger.info(f"准备升级 {len(need_upgrade)} 个模组")

    # 处理确认
    if not auto_confirm:
        print(t("autofix.will_upgrade", count=len(need_upgrade)), flush=True)
        for rec in need_upgrade:
            mod_id = rec.get("mod_id", "?")

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · core/auto_fix.py (reported line 504)May include surrounding context.

python
crash_log = getattr(args, "crash_log", None)
    output_dir = getattr(args, "output", None)
    offline = getattr(args, "offline", False)
    auto_confirm = getattr(args, "auto_confirm", False)

    if not mods_dir:
        return config.make_result(

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · core/auto_fix.py (reported line 504)May include surrounding context.

python
crash_log = getattr(args, "crash_log", None)
    output_dir = getattr(args, "output", None)
    offline = getattr(args, "offline", False)
    auto_confirm = getattr(args, "auto_confirm", False)

    if not mods_dir:
        return config.make_result(

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · core/auto_fix.py (reported line 573)May include surrounding context.

python
fix_result = auto_fix_mods(
        mods_dir=mods_dir,
        version_recommendations=version_recommendations,
        auto_confirm=auto_confirm,
    )

    # Step 3: 生成报告

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · core/auto_fix.py (reported line 573)May include surrounding context.

python
fix_result = auto_fix_mods(
        mods_dir=mods_dir,
        version_recommendations=version_recommendations,
        auto_confirm=auto_confirm,
    )

    # Step 3: 生成报告

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · locales/el_gr.json (reported line 183)May include surrounding context.

json
"help.action": "Τύπος ενέργειας (setup/backup/restore)",
  "help.activate": "Ενεργοποίηση κωδικού εξουσιοδότησης",
  "help.auth_status": "Προβολή κατάστασης άδειας",
  "help.auto_confirm": "Παράκαμψη προτύπων επιβεβαίωσης κατά την αυτόματη επιδιόρθωση",
  "help.config": "Διαδρομή αρχείου ρυθμίσεων JSON (λειτουργία δέσμης)",
  "help.crash_log": "Διαδρομή αναφοράς συντριβής ή αρχείου latest.log",
  "help.detail_level": "Επίπεδο λεπτομέρειας (basic/detailed)",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · locales/en_us.json (reported line 350)May include surrounding context.

json
"help.crash_log": "Crash report or latest.log file path",
  "help.offline": "Disable online queries, use local database only",
  "help.fix_mods_dir": "Minecraft mods directory path (for auto-fix)",
  "help.auto_confirm": "Skip confirmation prompts during auto-fix",
  "help.from_mc_version": "Source MC version (e.g. 1.20.1)",
  "help.to_mc_version": "Target MC version (e.g. 1.21.1)",
  "help.from_loader": "Source loader",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · locales/es_es.json (reported line 183)May include surrounding context.

json
"help.action": "Tipo de acción (setup/backup/restore)",
  "help.activate": "Activar código de autorización",
  "help.auth_status": "Ver estado de licencia",
  "help.auto_confirm": "Omitir prompts de confirmación durante la reparación automática",
  "help.config": "Ruta del archivo de configuración JSON (modo por lotes)",
  "help.crash_log": "Ruta del informe de fallos o archivo latest.log",
  "help.detail_level": "Nivel de detalle (basic/detailed)",