ClawHub
Back to skill

Security audit

Yufluent Clawhub Publish Yufluentcn Inventory Pilot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cloud inventory-analysis client that sends user-provided sales and stock data to a configured Yufluent endpoint using an API key.

Install only if you are comfortable sending the sales, inventory, stock, cost, and related business data you provide to Yufluent’s configured cloud endpoint. Keep TOKENAPI_KEY private, avoid placing highly sensitive files in CLI arguments unless intended, and do not set TOKENAPI_BASE_URL to an untrusted or non-HTTPS remote service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:
Confidence
95% confidence
Finding
The code allows the base URL to come from an environment variable and then uses it directly for authenticated POST requests, including the Bearer API key and arbitrary payload data. Because the default fallback is plain HTTP and there is no allowlist or HTTPS enforcement, a malicious or misconfigured environment can redirect secrets and business data to an attacker-controlled endpoint (SSRF/exfiltration-by-configuration).

Vague Triggers

Medium
Confidence
78% confidence
Finding
Several trigger phrases, especially broad ones like '库存管理' and 'inventory forecast,' are generic and likely to overlap with normal conversation. Overbroad activation can cause unintended invocation of the skill, leading to unnecessary file access, environment use, or transmission of seller inventory and sales data to the vendor cloud.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill description emphasizes inventory analysis but does not prominently warn that seller sales and inventory data will be transmitted to a cloud service for processing. Because these datasets can reveal commercially sensitive operational information, insufficient disclosure increases the risk of users sharing sensitive data without informed consent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script sends seller-provided inventory, sales, cost, and stock data to a cloud service via run_skill() without any explicit user-facing disclosure or consent prompt in the code path. Because this skill is specifically designed for business analytics, the transmitted data is likely commercially sensitive; unauthorized or unexpected transfer could expose confidential operational information.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The client can send inventory payloads and the API key over HTTP because the default base URL is http://localhost:8080/v1 and there is no transport-security validation or warning. In contexts where the base URL is changed to a remote non-TLS endpoint, credentials and sensitive business data could be intercepted or modified in transit.

Static analysis

No suspicious patterns detected.