ClawHub
Back to skill

Security audit

mubu-integration

Security checks across malware telemetry and agentic risk

Overview

This Mubu integration is mostly purpose-aligned, but its safety boundary overstates confirmation and local-write limits for a credentialed tool that can change real account data.

Review this before installing if you connect a real Mubu account. Use a dedicated/low-risk account if possible, protect ~/.mubu_token and ~/.workbuddy/.env.mubu, and do not rely on --yes as a universal safeguard because several write commands do not require it. Treat export-tree as a bulk local copy of your Mubu content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill declares no formal permissions, yet the content clearly describes capabilities to read credentials from environment variables and local files, write token/trash state to disk, execute shell commands, and make authenticated network requests to a remote service. This creates a misleading trust boundary for users and host systems, because the skill can access sensitive secrets and perform real remote actions without an explicit machine-readable permission declaration.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The tests reveal capabilities beyond the declared skill scope: recursive local search and a local trash/soft-delete layer. Undeclared file-system-affecting behavior expands the trust boundary, can surprise users, and increases the chance of unintended local data discovery or retention of sensitive note metadata on disk.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The tests show additional export features not described in the manifest, including whole-tree export and OPML/Freeplane generation. Undisclosed bulk export materially increases exfiltration and over-collection risk because a user may expect single-note operations while the tool can write large local copies of remote content.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger words are broad enough that ordinary mentions of “幕布” or “mubu” in user conversation could activate the skill without clear user intent to perform account-linked actions. Because this skill can read, create, modify, move, export, and delete Mubu content, unintended invocation could expose or alter user data if an agent auto-runs the skill based on casual mentions.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger keywords are very broad (e.g., '幕布' and 'mubu') and provide no scope constraints, exclusions, or confirmation requirements before activation. In an agent setting, this can cause the skill to activate on incidental mentions and perform credentialed read/write operations against a user's Mubu account without sufficiently clear user intent.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes very broad keywords such as '幕布' and 'mubu', which can match ordinary conversation and cause the agent to invoke a credentialed skill unexpectedly. In this skill's context, accidental activation is more dangerous because invocation can lead to authenticated access to a real remote account and, with confirmation flows, potentially destructive cloud operations.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation guidance says to use the skill whenever the user mentions Mubu-related operations, which is ambiguous and can cause over-eager invocation on loosely related prompts. Because the skill uses stored credentials and talks to a real third-party service, an overly broad activation condition increases the risk of unintended data access or remote modifications.

Credential Access

High
Category
Privilege Escalation
Content
# --------------------------------------------------------------------------- #
# 10. M2 T5 — .env 凭据加载（仅环境变量未设置时补全）
# --------------------------------------------------------------------------- #
class TestEnvFileLoading:
    def test_loads_when_env_unset(self, tmp_path, monkeypatch):
Confidence
80% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
assert "FOO" not in mubu_api.os.environ

    def test_env_key_stripped(self, tmp_path, monkeypatch):
        """回归：.env 键名两侧空白需被 key.strip() 去除（M2 第 125 行）。"""
        monkeypatch.delenv("MUBU_PHONE", raising=False)
        env = tmp_path / ".env.mubu"
        env.write_text('  MUBU_PHONE = 13800000000  \n', encoding="utf-8")
Confidence
79% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
assert os.getenv("MUBU_PHONE") == "13800000000"

    def test_member_id_loaded_from_env_file(self, tmp_path, monkeypatch):
        """v1.3.9：MUBU_MEMBER_ID 纳入 .env 允许列表，未设环境变量时补全。"""
        monkeypatch.setattr(mubu_api.os, "environ", {})
        tok = tmp_path / "tok.json"
        monkeypatch.setattr(mubu.client, "TOKEN_FILE", tok)
Confidence
82% confidence
Finding
.env

Session Persistence

Medium
Category
Rogue Agent
Content
python3 scripts/mubu_api.py get <doc_id> --export markdown

# 从 Markdown 创建文档
python3 scripts/mubu_api.py create "我的文档" --folder <folder_id> --md ./outline.md

# 从 Markdown 更新文档
python3 scripts/mubu_api.py save <doc_id> --md ./outline.md
Confidence
81% confidence
Finding
create "我的文档" --folder <folder_id> --md ./outline.md # 从 Markdown 更新文档 python3 scripts/mubu_api.py save <doc_id> --md ./outline.md # 移动文档 python3 scripts/mubu_api.py move <doc_id> --target <folder_i

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
tests/test_mubu_api.py:706