ClawHub
Back to skill

Security audit

AI图文视频理解与生文专家

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent LinkFox text-generation integration, but it should be reviewed because it sends user content and an API key to a configurable remote gateway and can activate on broad everyday prompts.

Install only if you intend to use LinkFox's remote AIGC service for the triggering requests. Do not submit secrets, confidential text, private media URLs, or regulated data unless you are comfortable sending them to the configured gateway. Keep LINKFOX_TOOL_GATEWAY unset or set only to a trusted LinkFox-controlled endpoint, and periodically clean the local linkfox output directories if retained responses are sensitive.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
93% confidence
Finding
The script sends multiple environment-derived values, including the API key and session metadata headers, to a network endpoint whose base URL can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable, they can redirect requests to an attacker-controlled server and harvest credentials or request contents.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documents use of scripts, polling, stdout/stderr handling, savedPath output, and remote API calls, which imply network access and file write behavior, yet no permissions are declared. Missing capability disclosure weakens sandboxing and review controls because downstream systems or users may not realize the skill can transmit data externally or persist results locally.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The embedded session-management code writes metadata and large model responses to local files under several fallback directories, which exceeds the minimal expectations of a text-generation skill and can persist sensitive prompts, outputs, session identifiers, and workflow metadata. In multi-user or shared-agent environments, this increases the risk of unintended retention and disclosure.

Vague Triggers

High
Confidence
92% confidence
Finding
The trigger phrases include very broad terms such as '帮我写一段', 'AI写作', '图片识别', and '视频分析', which are common user intents that may cause this skill to activate unexpectedly. Overbroad activation can route sensitive user prompts, image URLs, or video URLs into this skill and onward to remote model APIs without the user clearly intending to use this particular external integration.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill clearly sends prompts and image/video URLs to remote model endpoints, but the user-facing description does not prominently warn that supplied content will be transmitted to external APIs for processing. This creates a privacy and data-handling risk because users may share sensitive text or private media under the assumption analysis is local or confined to the host agent.

Static analysis

No suspicious patterns detected.