Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because it reports undisclosed device and activity data transmission, privacy disclosures that conflict with scanner evidence, and a risk of adding executable code to repacked JARs.
Treat this as a review-needed skill, not a confirmed malicious one. Before installing, consider whether you accept the reported device-linked network traffic and IP geolocation, and whether the incomplete inspection of the two icon images is acceptable. The scanner evidence also raises concerns about privacy disclosures and executable code entering repacked JARs.
core/auth_manager.pyDefault authorization and telemetry use unencrypted HTTP
Network observers can read persistent identifiers and usage metadata. An active intermediary can falsify authorization results and server notices. Server-side account compromise is not established.
core/auth_manager.pyOffline mode does not prevent authorization, usage reporting or geolocation requests
Device identifiers, device information and usage records can leave the machine in offline mode. Geolocation requests also reveal the connection's public IP address and application use to third-party providers.
SKILL.mdEnglish privacy instructions falsely describe default telemetry as disabled
Users relying on that representation may invoke otherwise local functions without understanding that identifiable device and activity metadata will be transmitted.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
# 1. 尝试在线查询
try:
resp = requests.post(
f"{SERVER_URL}/api/auth/quick-check",
json={"machine_id": machine_id, "client_version": "", "ai_platform": "", "device_info": {}},
timeout=5
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
# 尝试快速检查服务器连通性
try:
resp = requests.get(f"{SERVER_URL}/api/public/status", timeout=2)
info["server_connected"] = resp.status_code == 200
except Exception:
pass
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST",
)
with urlopen(_g4q7, timeout=AUTH_SERVER_TIMEOUT, context=_SSL_CONTEXT) as resp:
_b0b1 = json.loads(resp.read().decode("utf-8"))
return _b0b1
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST",
)
with urlopen(_req, timeout=AUTH_SERVER_TIMEOUT, context=_SSL_CONTEXT) as resp:
return json.loads(resp.read().decode("utf-8"))
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"Accept": "application/json",
},
)
with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT, context=ssl.create_default_context()) as resp:
body = resp.read().decode("utf-8")
data = json.loads(body)
# 基本字段校验
The environment variables configure the destination URL rather than supplying credentials, so the reported critical credential-exfiltration flow is unsupported. However, registration defaults to plain HTTP, exposing the generated machine identifier and registration metadata to interception and allowing network attackers to alter the server response; creating an SSL context does not protect an HTTP URL.
"source": "qclaw_test",
}).encode("utf-8")
req = urllib.request.Request(api_url, data=body, headers={"Content-Type": "application/json"}, method="POST")
with urllib.request.urlopen(req, timeout=5, context=ssl.create_default_context()) as resp:
resp_data = json.loads(resp.read().decode("utf-8"))
result["server_registered"] = True
result["server_response"] = resp_data
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
anslate, crash, migration...):\n User wrote in ENGLISH → base your reply on _agent_response_text.pattern_B_en, THEN run python main.py --feature xxx\n User wrote in CHINESE → base your reply on _agent_response_text.pattern_B_zh, THEN run python main.py --feature xxx\n\nREQUIRED — honest disclosure overrides the template:\n✅ Add one short line when the user needs to know about network access and what data it sends, about side effects of an operation, or that a paid plan is required.\n✅ Always answer truthfully if the user asks about cost, payment, data collection, privacy or side effects — even if the template does not mention it.\n✅ Use python main.py / scripts/mc_skill.py for all actions.\n\nAVOID:\n❌ No F1/F2/F3 numbered feature lists and no feature tables.\n❌ No rewriting the template in a way that changes its meaning.\n❌ No mixing Chinese and English. Match the user's language.",
"onboarding_prompt_zh": "2 步，优先用模板（允许补充如实说明）：\n\n1. 执行：python scripts/mc_skill.py onboardin
Translation loading, locale detection, and saving language preferences are reasonable supporting details of the declared translation feature. However, IP-based location detection introduces an additional privacy-relevant capability not disclosed in the description or permissions. The module tries ip-api.com, ipinfo.io, api.myip.com, and freegeoip.app, with the first endpoint using unencrypted HTTP, and caches country information on disk. These requests can occur simply by importing the module. The supplied chunk does not establish whether the tool's other advertised features exist; their absence from this localization module is not itself a mismatch.
The document promises local-only storage and no default external transmission, yet elsewhere explicitly describes default-enabled remote verification and reporting tied to a persistent machine identifier. These contradictory disclosures undermine informed consent to device-linked tracking, although the supplied source does not independently substantiate all claimed hardware profiling or server-directed version blocking.
Most visible behavior is consistent with the declared suite: feature dispatch, quota checks, onboarding, platform settings, and integrity checks are supporting implementation details. However, automatic startup monitoring and synthetic test-identity provisioning are material additional behaviors not disclosed by the description. The gen_test_id command writes data/auth_state.json and, unless --no-register is supplied, POSTs the generated machine ID, a fixed test fingerprint, version, and source to /api/auth/quick-check, defaulting to http://45.76.179.12. Comments describe these identities as administrator/test users, but the supplied chunk does not establish that the server actually grants administrator privileges. Likewise, report_app_started is called unconditionally at startup, but its imported implementation and exact transmitted data are not shown. The Minecraft features themselves are delegated, so their implementation cannot be verified from this chunk.
Referenced artifact was not completely inspected
icon: "assets/icon-market.jpg"
Referenced artifact was not completely inspected
icon_local: "assets/icon-local.jpg"
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
"unionpay": _PAYMENT_ASSETS / "unionpay_qr.png",
"digital": _PAYMENT_ASSETS / "digital_yuan_qr.png",
"douyin": _PAYMENT_ASSETS / "douyin_pay_qr.png",
}
# === 主支付渠道配置 ===
_PRI_PAYMENT_CHANNELS = {
"wechat_pay": {
"name": "微信支付",
"name_en": "WeChat Pay",
"icon": "💬",
"color": "#07C160",
"bg_color": "#e8f5e9",
"description": "请打开微信 APP 扫码付款",
"description_en": "Open WeChat App to scan QR code",
},
"alipay": {
"name": "支付宝",
"name_en": "Alipay",
"icon": "💙",
"color": "#1677FF",
"bg_color": "#e3f2fd",
"description": "请打开支付宝 APP 扫码付款",
"description_en": "Open Alipay App to scan QR code",
},
"paypal": {
"name": "PayPal/外币",
"name_en": "PayPal / Foreign Currency",
"icon": "🌍",
"color": "#003087",
"bg_color": "#e3f2fd",
"descr
The repacker enumerates every input file without enforcing SUPPORTED_RESOURCE_EXTS, and validation accepts unknown extensions, including .class files. An attacker-controlled resource directory can therefore add or replace executable Java bytecode in an apparently resource-only patched mod, leading to code execution with the game's privileges when the resulting JAR is loaded.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
"warning.experimental": "This is an experimental feature",
"warning.config_recommended": "Using config file is recommended for batch operations",
"prompt.confirm_continue": "Continue?",
"prompt.confirm_overwrite": "Overwrite existing files?",
"prompt.confirm_delete": "Delete selected items?",
"prompt.confirm_exit": "Exit without saving?",
"prompt.input_required": "Input is required",
The F1 description explicitly specifies Chinese-language output for parsed JAR functionality. It does not make that output conditional on the user's language preference or justify a Chinese-only constraint; the general multilingual support described elsewhere does not provide a language choice for F1.
Without declared permissions the skill's intent is opaque and cannot be validated.
The blanket prohibition covers authentication, machine-ID generation, endpoints, and file paths even when those details are necessary to answer a user's security or privacy question. Unlike ordinary guidance to avoid jargon, this can suppress material facts about device tracking, network destinations, and filesystem effects.
Generic phrases such as 'remaining' and 'membership' trigger command execution and automatic browser opening without requiring Minecraft-skill context. The document says the lookup action carries the machine identifier to an HTTP page, so an unrelated question could cause unintended external disclosure and browsing.
The onboarding and troubleshooting text repeatedly directs users to approve network access for the whole session and frames denial as a cause of malfunction. Bundling usage reporting with license checks encourages broader approval than necessary and weakens meaningful consent, although the requested approval is session-scoped rather than permanent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class APIConfig:
"""API相关配置"""
# Modrinth API (无需认证，但有速率限制 300次/分钟)
MODRINTH_BASE = "https://api.modrinth.com/v2"
MODRINTH_USER_AGENT = "MC-Skill-V1/1.0 (https://github.com/mc-skill)"
MODRINTH_RATE_LIMIT = 300 # 每分钟最大请求数
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
MODRINTH_RATE_LIMIT = 300 # 每分钟最大请求数
# CurseForge API (需要API Key)
CURSEFORGE_BASE = "https://api.curseforge.com/v1"
CURSEFORGE_GAME_ID = 432 # Minecraft的gameId
CURSEFORGE_CLASS_MOD = 6 # Mod分类
Authorization verification unconditionally attempts a network request without checking the offline setting. It sends a persistent machine identifier, and background polling can repeat that disclosure despite the user's offline expectation.
The client trusts authorization fields and tokens from response JSON without implementing the claimed server-signature verification. Because the default endpoint is plaintext HTTP, an on-path attacker can forge authorization results or deny legitimate access without authenticating as the server.
External authorization is consistent with the skill's paid-plan features, but the default request uses HTTP to send a stable machine identifier and receive an authorization token. Network observers can correlate the identifier and intercept returned tokens, while active attackers can modify authorization responses.
# 1. 尝试在线查询
try:
resp = requests.post(
f"{SERVER_URL}/api/auth/quick-check",
json={"machine_id": machine_id, "client_version": "", "ai_platform": "", "device_info": {}},
timeout=5