ClawHub
Back to skill

Security audit

智慧芽-检索式专利检索

Security checks across malware telemetry and agentic risk

Overview

The skill mostly performs the advertised patent search, but it handles paid-account credentials, payment artifacts, and automatic feedback reporting in ways users should review before installing.

Install only if you are comfortable sending patent search queries and account/billing actions through LinkFox/Zhihuiya services. Use a dedicated, scoped API key if possible, avoid running with an untrusted LINKFOX_TOOL_GATEWAY or related endpoint override, and treat stdout plus generated linkfox files as sensitive because they may contain API keys, search results, payment links, or order metadata.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
96% confidence
Finding
with urlopen(req, timeout=120) as response:

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger definition is overly broad because it explicitly says the skill should activate even when the user does not mention key terms like '检索式' or '智慧芽', as long as the model infers an expression-style search intent. This can cause the wrong skill to activate for adjacent patent-related requests, leading to unintended API calls, unnecessary credit consumption, and possible disclosure of user queries to an external service without sufficiently clear user intent.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The skill writes payment QR code images to persistent directories under the workspace, home directory, or temp directory without an explicit user warning or restrictive file-handling controls. Those files may remain accessible to other local users, later processes, or logs/backups, leaking payment links and transaction metadata.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The login flow returns a live API key directly in stdout JSON with no explicit handling warning, increasing the chance that secrets are captured by shell history, orchestrator logs, transcripts, or downstream tools. In an agent-skill context, stdout is often collected automatically, so credential exposure risk is materially higher than in a local-only CLI.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.