ClawHub
Back to skill

Security audit

moonshot skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible multimodal API tool, but it can send images, prompts, and the API key to a configurable remote endpoint with weak disclosure and overly broad activation triggers.

Review this before installing. Only use it with non-sensitive images or documents unless you trust the configured API endpoint and provider data handling. Do not set BASE_URL to an untrusted host, avoid sharing terminal output from config checks, and expect the current package to need fixes before it runs correctly.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Note
Location
cli.py:267
Finding

API Key Fragments Are Exposed in Terminal Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
client.py:106
Finding

Unrestricted API Base URL Can Redirect Credentials and User Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (74)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALLATION.md (reported line 53)May include surrounding context.

bash
# 复制环境变量示例文件
cp .env.example .env

# 编辑 .env 文件，填入你的 API Key
# 获取 API Key: https://platform./

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

声明与代码部分一致：代码确实演示了多模态对话、图像分析场景以及文案/创意写作相关用途。但存在明显不一致之处。首先，声明特别提到OCR提取，而该代码片段没有任何专门的OCR调用、文本识别接口或提取流程，只是把图片路径传入对话接口要求模型分析图片。其次，代码的主要内容实际上是一个通用多场景会话示例集合，涵盖学习辅导、商业咨询、代码审查、角色扮演和会话历史管理等，这比声明的能力范围更宽。虽然这些可以被视为大模型对话的延伸，但从“描述是否准确代表代码实际行为”角度看，声明遗漏了代码所展示的重要通用会话能力，同时包含未被代码体现的OCR能力，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

代码块内容明显聚焦于“图像分析示例”。它展示了对图片进行描述、批量分析、不同模型对比，以及基于两张图片分析结果再进行一次文本对比总结。虽然最后的 compare_images 使用了 conversation.chat，但输入是前面生成的文本分析结果，而不是与图像直接进行多模态对话，因此不足以支撑声明中的“多模态对话”能力。更重要的是，代码中完全没有看到 OCR 文本提取流程，也没有专门的文案创作功能示例。故声明覆盖的能力明显多于代码实际体现的行为，属于描述与代码行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

从该代码片段看，实际行为集中在辅助工具层：验证图片文件、获取图片元信息、缩放与转PNG、批量处理图片、估算token、处理文件名、创建输出目录、读取本地prompt模板等。这些功能可以作为图像分析类技能的支撑模块，但当前片段本身并没有展示任何与大模型交互、OCR识别、图像内容理解、文案生成或多模态对话相关的实现。因此，声明的主要用途与所给代码片段的实际功能存在明显不一致。尽管其中的图片处理可能是上层能力的辅助部分，但就本片段而言，核心描述被显著夸大，且代码还涉及未在声明中体现的本地文件系统访问能力。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALLATION.md (reported line 55)May include surrounding context.

md
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cli.py (reported line 43)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cli.py (reported line 271)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cli.py (reported line 274)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cli.py (reported line 276)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quickstart.py (reported line 66)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quickstart.py (reported line 72)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quickstart.py (reported line 77)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quickstart.py (reported line 79)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quickstart.py (reported line 201)May include surrounding context.

python
api_key = os.getenv("")
    if not api_key:
        console.print("✗ 错误: 未找到  API Key", style="red")
        console.print("\n请设置环境变量  或创建 .env 文件:", style="yellow")
        console.print("=", style="cyan")
        console.print("\n获取 API Key: https://platform./", style="blue")
        sys.exit(1)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list contains very short and ambiguous phrases such as "用 ", "文案创作", and generic image-related requests that can match ordinary conversation and unintentionally invoke the skill. In an agent environment, overly broad activation can route user data or tasks to this external API unexpectedly, increasing the risk of unintended data exposure or misuse of the tool.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cli.py (reported line 272)May include surrounding context.

python
"""设置环境变量文件"""
    print("\n📝 配置环境变量...")

    env_file = Path(".env")
    env_example = Path(".env.example")

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quickstart.py (reported line 62)May include surrounding context.

python
"""设置环境变量文件"""
    print("\n📝 配置环境变量...")

    env_file = Path(".env")
    env_example = Path(".env.example")

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quickstart.py (reported line 74)May include surrounding context.

python
"""设置环境变量文件"""
    print("\n📝 配置环境变量...")

    env_file = Path(".env")
    env_example = Path(".env.example")

    if env_file.exists():

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The guide advertises image analysis, OCR, copywriting, and multimodal chat via an external API, but it does not clearly warn users that images and text may be transmitted to a remote service. This can lead users to unknowingly send sensitive documents, screenshots, or personal data off-device, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README instructs users to configure an API key and use cloud-backed image/OCR/chat features, but it does not clearly warn that uploaded images and extracted text may leave the local machine and be transmitted to a remote service. This is dangerous because users may assume the tool is fully local or privacy-preserving, especially given the wording about '本地部署' and '保护数据隐私', and may unintentionally send sensitive screenshots, documents, or personal data to an external API.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This Python file contains natural-language UI strings and help text exclusively in Chinese, beginning with the module description and continuing throughout command help and prompts. The skill does not offer any locale selection or user opt-in, which can violate language/locale policy for general-purpose tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The config command reads the API key from the environment and displays part of it to the terminal. Even partial credential disclosure is unnecessary for the tool’s core function and can leak sensitive data through screenshots, terminal logs, shell history capture, or shared sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill embeds Chinese prompts and assistant instructions such as '请详细分析这张图片' and Chinese system messages, which steer outputs toward a specific language/locale by default. The file does not provide an explicit language choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The image analysis method base64-encodes a local image and sends it to a remote chat completion endpoint, but the API surface and method behavior do not provide any user-facing disclosure, consent, or privacy warning. This is risky because callers may process sensitive local images (IDs, receipts, internal screenshots, faces) without realizing they are being transmitted off-device to a third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.