ClawHub
Back to skill

Security audit

知了商机大师-商机Agent

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a legitimate API client, but it handles an API key and business data while allowing the API destination to be changed without host validation.

Install only if you trust the publisher and the zhiliaobiaoxun.com service. Keep ZLBX_AGENT_BASE unset unless you intentionally use a trusted endpoint, avoid pasting or logging the full API key, and review task-create commands because they can create recurring external tasks, notifications, and credit usage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'req' from os.getenv (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
if data is not None:
        req.add_header("Content-Type", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=310) as resp:
            raw = resp.read().decode("utf-8")
            return json.loads(raw) if raw else None
    except urllib.error.HTTPError as e:
Confidence
95% confidence
Finding
with urllib.request.urlopen(req, timeout=310) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to read an API key from environment variables and call an external network API, but the skill metadata does not declare these capabilities or permissions. Undeclared access to secrets and outbound network use weakens transparency and policy enforcement, and could enable unintended disclosure of credentials or external data exfiltration if the skill is invoked in a broader agent runtime.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:36