ClawHub
Back to skill

Security audit

x2c-real-dashboard

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently queries an X2C dashboard API for earnings and activity data, with no evidence of hidden execution, persistence, or unrelated data access.

Install only if you trust the X2C API endpoint and are comfortable giving this skill access to your X2C earnings, transaction, project, and platform-view data. Use a scoped or revocable X2C_API_KEY where possible, and invoke it only for X2C dashboard questions because returned data may be financially sensitive.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill advertises broad dashboard and earnings-query functionality while the analysis indicates the implemented behavior is narrower and also requires authenticated external API access that is not properly declared. This mismatch is dangerous because users and orchestration systems may authorize or invoke the skill under false assumptions, leading to unexpected data access, over-privileged execution, or trust in outputs the skill cannot actually support.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README advertises very broad, natural-language trigger phrases such as asking how much was earned today or requesting recent transactions, without any invocation constraints, authorization caveats, or privacy exclusions. In an agent ecosystem, this can cause over-eager routing of ordinary user messages to a skill that retrieves sensitive financial/account data, increasing the chance of unintended disclosure or unnecessary access to private dashboard information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell scripts but does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent may execute shell-based actions without clear least-privilege constraints or user/auditor visibility into what execution capability is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description does not warn that it uses an API key to query sensitive personal financial and transaction data. Without clear disclosure, users may invoke it without understanding that highly sensitive earnings, ROI, project, and transaction information will be retrieved from an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/earning-projects.sh (reported line 29)May include surrounding context.

sh
exit 1
fi

curl -sS -X POST "$API_URL" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"dashboard/platform-breakdown"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/overview.sh (reported line 16)May include surrounding context.

sh
exit 1
fi

curl -sS -X POST "$API_URL" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"dashboard/platform-breakdown"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/platform-breakdown.sh (reported line 16)May include surrounding context.

sh
exit 1
fi

curl -sS -X POST "$API_URL" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"dashboard/platform-breakdown"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/recent-activity.sh (reported line 23)May include surrounding context.

sh
exit 1
fi

curl -sS -X POST "$API_URL" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"dashboard/platform-breakdown"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/trend.sh (reported line 23)May include surrounding context.

sh
exit 1
fi

curl -sS -X POST "$API_URL" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"dashboard/platform-breakdown"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code performs a POST request to a remote API and includes the X2C_API_KEY credential in the request headers. While the file notes that the environment variable is required, it does not visibly warn the user that the script will send data and a credential to an external service via curl.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This shell script performs an outbound HTTP POST and includes the X2C_API_KEY credential in a request header, but there is no runtime notice, confirmation, or explanatory comment describing that it will contact a remote Supabase endpoint. For code files, network calls that transmit system data or credentials should have some visible disclosure unless the behavior is clearly documented as the skill's purpose; here the comments describe the dashboard function but not the remote transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This shell script sends a POST request to a remote API and includes the X2C_API_KEY credential in an HTTP header, but there is no confirmation prompt or user-facing notice at the point of transmission. While the script header notes that the environment variable is required, it does not clearly warn that the key will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language label '收益趋势' indicates a fixed Chinese-language presentation in the skill metadata/comments, with no indication that the user can choose another language or locale. Under the stated policy, hard-coded language constraints can be a locale-policy issue when they are not optional or justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.