ClawHub
Back to skill

Security audit

结构化决策专家

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly coherent as a LinkFox decision workflow, but it can create persistent monitoring tasks and handle credentials, uploads, and payments without enough scoping or confirmation.

Review this before installing. Use it only if you are comfortable sending prompts, media references, and account-scoped LinkFox API credentials to LinkFox services, and require explicit confirmation before any scheduled monitoring task, public file upload, order creation, or payment action. Use a scoped/rotatable API key, avoid uploading sensitive local files, and do not set LinkFox gateway environment variables to untrusted endpoints.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (6)

T06 · System Persistence

Error
Location
SKILL.md:91
Finding

Mandatory Creation of Persistent Monitoring Tasks Without Explicit User Consent

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
skills/default-superagent-loop/SKILL.md:31
Finding

Hard-Coded Branded Recommendations Manipulate Final Agent Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:321
Finding

Authentication Credentials Can Be Transmitted to Arbitrary Environment-Selected Endpoints

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aigc-textgen/scripts/onboarding.py:478
Finding

Onboarding Emits the Complete Generated API Key to Standard Output

Content
View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print( f"{TAG} API key obtained successfully (source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` ### Technical Analysis After SMS login, the script retrieves or generates an API token and includes the complete token in the returned dictionary. `_cmd_login` serializes that dictionary directly to stdout. Standard output is commonly captured by: - Agent tool transcripts. - CI and automation logs. - Shell redirection. - Terminal scrollback. - Process supervisors. - Notebook outputs. - Debugging and telemetry systems. Consequently, a long-lived credential may be retained in multiple locations outside the intended credential boundary. ### Attack Path 1. A user invokes the onboarding login command with a phone number and SMS code. 2. The script authenticates and obtains an existing or newly generated API token. 3. `login_and_get_key` returns the complete token in the `api_key` field. 4. `_emit` writes the complete JSON object to stdout. 5. A tool wrapper, transcript store, log collector, or another local user with log access obtains the token. 6. The exposed token is replayed again ...[truncated 427 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skills/linkfox-file-upload/scripts/file_upload.py:39
Finding

File Upload CLI Can Publish Any Locally Readable File Without an Enforced Workspace Boundary

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skills/linkfox-file-upload/SKILL.md:32
Finding

Runtime Installation Guidance Uses Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (105)

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The script builds outbound requests using environment-derived values for the base URL and sensitive headers, then sends the full task payload to that destination. If LINKFOX_TOOL_GATEWAY is overridden or the environment is attacker-influenced, the skill can exfiltrate prompts, generated content, API credentials, and session metadata to an unintended remote endpoint.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Description-Behavior Mismatch

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements account onboarding, SMS login, API key issuance, package listing, order creation, and payment QR generation, which is fundamentally inconsistent with the declared structured decision-making skill purpose. This capability mismatch is a strong indicator of deceptive packaging and materially increases the risk that users or orchestrators will invoke credential and payment operations they did not intend to authorize.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The POST target URL is derived from environment-controlled base URLs, and the same request may carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and headers including authorization/uid. In a skill environment, an attacker who can influence env vars can redirect these requests to an attacker-controlled host and exfiltrate credentials or personal data.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The gateway request URL is built from an environment-controlled base and is used with an Authorization header containing the API key. If the environment is tampered with, the CLI will send authenticated requests to an attacker-selected endpoint, exposing the API key and enabling follow-on account or billing abuse.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

download_media() fetches an attacker-controlled URL over HTTP/HTTPS and writes the response into local session storage. Although it blocks non-HTTP schemes, it still enables SSRF-style access to internal services, unintended outbound requests, and ingestion of untrusted content without host allowlisting or private-address filtering. The declared skill purpose is structured decision synthesis, so arbitrary network retrieval is unjustified and increases risk.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The function downloads arbitrary attacker-controlled HTTP/HTTPS URLs into local storage without any allowlist, destination validation, or SSRF protections. In an agent environment, this can be abused to make outbound requests to internal services, cloud metadata endpoints, or other sensitive network locations, even though the module is presented as a shared path utility for report generation.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

download_media performs arbitrary outbound HTTP/HTTPS fetches for a caller-supplied URL with no allowlist, host validation, or private-address blocking. In an agent environment, this creates SSRF risk and can be used to reach internal services, metadata endpoints, or attacker-controlled infrastructure, while also persisting downloaded content into the shared session directory.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 249, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The script forwards multiple environment-derived values into an outbound HTTP request, including a gateway base URL and custom headers such as SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME. Because LINKFOX_TOOL_GATEWAY can override the destination and the headers are sent unchanged, a compromised or attacker-controlled environment can redirect requests and exfiltrate sensitive runtime metadata and the API key to an arbitrary host.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/task_scheduler.py (reported line 264)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A structured decision skill that also manages scheduled tasks via external APIs, writes responses to local filesystem, and includes recurring-text and recursion controls has materially exceeded its stated function. Hidden automation and outbound API use can create persistent side effects and ongoing activity that users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Allowing the skill to self-extend via a skill creator is a major capability-escalation risk that is unjustified for a structured decision module. It can bypass normal review boundaries by enabling the module to add new behaviors dynamically, making its effective permissions and data flows unpredictable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The provided manifest context says this skill should be a '通用结构化决策模块' that ingests multi-dimensional findings and synthesizes a standardized decision block with scores, counter-evidence, and prioritized actions. In contrast, this file declares 'default-superagent-loop' and documents end-of-turn routing behavior such as AskUserQuestion preparation, agent-card recommendation, context generation, and handoff decisions, with no structured-decision-block semantics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description is written to operate in Chinese and the file repeatedly constrains user-visible content to specific Chinese phrasing and punctuation conventions, but there is no indication that the user can choose another language or locale. This creates a natural-language policy issue because the skill appears to impose a language format by default rather than offering opt-in or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough to match many ordinary requests, which can cause this skill to activate unexpectedly and send user prompts, images, or video URLs to a remote AI service without sufficiently specific user intent. In this skill's context, that risk is elevated because it supports multimodal inputs and automatic downstream chaining guidance, increasing the chance of unintended external processing and privacy exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file documents a text-generation API and related operational behavior, but the declared skill is a structured decision-making module. This mismatch is dangerous because it can cause an agent or integrator to invoke unrelated remote capabilities, send unintended user data to an external service, and bypass the trust boundaries implied by the skill metadata.

Content

No source excerpt is available for this finding.