ClawHub
Back to skill

Security audit

Yufluent Clawhub Publish Yufluentcn Record Outcome

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to record business outcome metrics, but its remote write scope and helper capabilities are broader than the stated purpose clearly explains.

Install only if you trust the backend service, keep the API token narrowly scoped, and control any TOKENAPI_BASE_URL setting. Before allowing the agent to submit data, require it to confirm the run_id, event type, numbers, and destination; review whether the generic remote skill execution helpers are actually needed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:
Confidence
95% confidence
Finding
The code allows the destination base URL to come from an environment variable and then uses it directly in requests.post with an Authorization bearer token. If TOKENAPI_BASE_URL is attacker-controlled, the client can be redirected to an arbitrary host, causing credential exfiltration and unintended transmission of payload data to untrusted infrastructure.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
Although the skill is described as an outcome-recording helper, this module also exposes generic skill execution via run_skill and agent-turn fallback, enabling broader remote actions than the manifest suggests. That scope expansion increases attack surface and could let a caller trigger arbitrary skill orchestration rather than only recording outcomes.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The README recommends invoking the skill based on broad conversational cues like 'Listing 上架了' or '这周卖了 N 单' plus presence of a prior run_id in the conversation. This can cause an agent to trigger outcome-recording on ordinary user chatter without a strong confirmation step, resulting in inaccurate or unauthorized submission of sales/click/exposure data to the remote /v1/agent/outcomes endpoint. Because this skill writes business metrics rather than just reading data, ambiguous invocation criteria are more dangerous in context.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases include broad, natural-language expressions such as '帮我记录效果' and '登记一下' that could plausibly occur in ordinary conversation. In an agent environment, this can cause unintended invocation of a networked skill that submits outcome data, potentially recording incorrect business metrics or causing actions the user did not mean to authorize.

Static analysis

No suspicious patterns detected.