ClawHub
Back to skill

Security audit

xianmu-ims

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed inventory-management connector for a user’s own Xianmu IMS instance, though installing it means the agent can change inventory records and manage files when given a write-capable token.

Install only if you intend the agent to operate your Xianmu IMS. Prefer a viewer token for lookup, a member token only when you want stock writes, and an admin token only for initialization. Review destructive file/document actions carefully because the artifact says those deletes are irreversible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
### 5. 图片与资料
- 加图片：`POST /items/{id}/attachments`（multipart，`file_type=image`，≤20MB）；调整顺序/封面用 `PUT /items/{id}/attachments/order`（ids 须覆盖全部附件，第一张为封面）。
- 加资料：链接用 `POST /items/{id}/docs`（后台抓取，稍后 `GET /docs?item_id=` 看结果）；本地文件用 `POST /docs/upload`（后缀白名单 pdf/docx/txt/md/png/jpg/xlsx/csv/pptx/zip 等）。
- 一份资料可关联多个物品（多对多）：改显示名用 `PATCH /docs/{doc_id}`（body `{"title": "…"}`）；追加关联用 `POST /docs/{doc_id}/items`（body `{"item_id": 123}`，幂等）；解除关联用 `DELETE /docs/{doc_id}/items/{item_id}`（资料本身保留）。注意 `GET /docs?item_id=` 的含义是「**包含**该物品的资料」，不等于唯一归属；列表行里 `items[]` 才是全部关联物品。
- 删除物品**不会**删除它名下的资料，只会解除关联（资料降级为未关联的全局资料）；资料被删除只有 `DELETE /docs/{doc_id}` 一条路径。
- 删除图片/资料均为不可恢复操作，先向用户确认再调用。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
### 5. 图片与资料
- 加图片:`POST /items/{id}/attachments`(multipart,`file_type=image`,≤20MB);调整顺序/封面用 `PUT /items/{id}/attachments/order`(ids 须覆盖全部附件,第一张为封面)。
- 加资料:链接用 `POST /items/{id}/docs`(后台抓取,稍后 `GET /docs?item_id=` 看结果);本地文件用 `POST /docs/upload`(后缀白名单 pdf/docx/txt/md/png/jpg/xlsx/csv/pptx/zip 等)。
- 一份资料可关联多个物品(多对多):改显示名用 `PATCH /docs/{doc_id}`(body `{"title": "..."}`);追加关联用 `POST /docs/{doc_id}/items`(body `{"item_id": 123}`,幂等);解除关联用 `DELETE /docs/{doc_id}/items/{item_id}`(资料本身保留)。注意 `GET /docs?item_id=` 的含义是「**包含**该物品的资料」,不等于唯一归属;列表行里 `items[]` 才是全部关联物品。
- 删除物品**不会**删除它名下的资料,只会解除关联(资料降级为未关联的全局资料);资料被删除只有 `DELETE /docs/{doc_id}` 一条路径。
- 删除图片/资料均为不可恢复操作,先向用户确认再调用。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

The skill exposes a destructive document-deletion endpoint and relies only on a prose note saying to confirm first. Since the skill is an operational agent that may act on natural-language input, exposing irreversible deletion without a stronger procedural safeguard creates a real risk of accidental or induced data loss.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
- 加图片：`POST /items/{id}/attachments`（multipart，`file_type=image`，≤20MB）；调整顺序/封面用 `PUT /items/{id}/attachments/order`（ids 须覆盖全部附件，第一张为封面）。
- 加资料：链接用 `POST /items/{id}/docs`（后台抓取，稍后 `GET /docs?item_id=` 看结果）；本地文件用 `POST /docs/upload`（后缀白名单 pdf/docx/txt/md/png/jpg/xlsx/csv/pptx/zip 等）。
- 一份资料可关联多个物品（多对多）：改显示名用 `PATCH /docs/{doc_id}`（body `{"title": "…"}`）；追加关联用 `POST /docs/{doc_id}/items`（body `{"item_id": 123}`，幂等）；解除关联用 `DELETE /docs/{doc_id}/items/{item_id}`（资料本身保留）。注意 `GET /docs?item_id=` 的含义是「**包含**该物品的资料」，不等于唯一归属；列表行里 `items[]` 才是全部关联物品。
- 删除物品**不会**删除它名下的资料，只会解除关联（资料降级为未关联的全局资料）；资料被删除只有 `DELETE /docs/{doc_id}` 一条路径。
- 删除图片/资料均为不可恢复操作，先向用户确认再调用。

### 6. 初始化引导（分类与位置一次配好）

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guardrail says write operations should be confirmed first, but then allows skipping confirmation when the instruction seems clear. For an inventory-management skill with stock movements, adjustments, and initialization writes, this exception undermines the safety control and can lead to irreversible or business-impacting changes from ambiguous or misrouted user input.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
## 护栏（必须遵守）

1. **写操作前先复述确认**：入库/出库/移库/调整/建档/初始化写入前，向用户复述关键内容（物品 + 数量 + 目标库位，或配置预览），得到确认再调用。用户指令已非常明确时可省略复述直接执行。
2. **禁触端点**：不要调用设置（`/settings`，含 AI 密钥）、授权（`/license`）、Token/Webhook 管理、用户管理等系统端点；也不要调用物品删除/物理删除/并库/停用（`DELETE /items/{id}`、`/purge`、`/merge`、`/disable`）——这些留给用户在界面操作。
3. **出错不删数据**：有流水的物品不可删除只能停用；写错了提示用户在界面用「冲正」功能回退，Agent 不要自行尝试补救性反向操作。
4. **一次一步**：批量写入逐条执行，每条之间检查响应；某条失败（如 OUT_OF_STOCK）就停下报告，不要跳过继续。
5. **数量与单位照抄用户口径**，不主动换算；价格字段留 0 表示未计价。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
## 护栏(必须遵守)

1. **写操作前先复述确认**:入库/出库/移库/调整/建档/初始化写入前,向用户复述关键内容(物品 + 数量 + 目标库位,或配置预览),得到确认再调用。用户指令已非常明确时可省略复述直接执行。
2. **禁触端点**:不要调用设置(`/settings`,含 AI 密钥)、授权(`/license`)、Token/Webhook 管理、用户管理等系统端点;也不要调用物品删除/物理删除/并库/停用(`DELETE /items/{id}`、`/purge`、`/merge`、`/disable`)——这些留给用户在界面操作。
3. **出错不删数据**:有流水的物品不可删除只能停用;写错了提示用户在界面用「冲正」功能回退,Agent 不要自行尝试补救性反向操作。
4. **一次一步**:批量写入逐条执行,每条之间检查响应;某条失败(如 OUT_OF_STOCK)就停下报告,不要跳过继续。
5. **数量与单位照抄用户口径**,不主动换算;价格字段留 0 表示未计价。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

This endpoint performs irreversible deletion of attachments, including removal of the underlying disk file. In an agent context, exposing destructive operations without enforced confirmation, scoping, and ownership verification increases the risk of accidental or manipulated data loss through prompt injection or parameter misuse.

Content

Scanner excerpt · references/api.md (reported line 107)May include surrounding context.

md
### PUT /items/{id}/attachments/order — 附件重排
Body `{"ids":[附件id…]}`，**必须与该物品现有全部附件一一对应**；列表第一张图片即封面。

### DELETE /attachments/{att_id} — 删除附件
磁盘文件同删，不可恢复；调用前先向用户确认。

### POST /items/{id}/docs — 添加资料链接

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

This endpoint can silently sever document-to-item associations, which may disrupt traceability and operational workflows even though the document itself is retained. In an agent setting, attacker-controlled or ambiguous parameters could cause unintended unlinking of records if the skill does not enforce strong confirmation and object validation.

Content

Scanner excerpt · references/api.md (reported line 125)May include surrounding context.

md
### POST /docs/{doc_id}/items — 资料关联到物品
Body `{"item_id":123}`；幂等（重复关联直接返回现状）。一份资料可关联多个物品，关联后该物品详情页的资料列表即包含它，返回更新后的资料行（含 `items[]`）。

### DELETE /docs/{doc_id}/items/{item_id} — 解除资料与物品的关联
只解除关联，**资料本身保留**；解除后不再关联任何物品时成为未关联的全局资料。

### DELETE /docs/{doc_id} — 删除资料

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

This endpoint permanently deletes documents and the associated stored file, making mistakes unrecoverable. In a tool-using agent, destructive delete capabilities materially increase the blast radius of prompt injection, hallucinated identifiers, or user-intent confusion, especially when the documentation merely advises confirmation instead of technically enforcing safeguards.

Content

Scanner excerpt · references/api.md (reported line 128)May include surrounding context.

md
### DELETE /docs/{doc_id}/items/{item_id} — 解除资料与物品的关联
只解除关联，**资料本身保留**；解除后不再关联任何物品时成为未关联的全局资料。

### DELETE /docs/{doc_id} — 删除资料
文件类同清落盘，不可恢复。另注：删除**物品**不会连带删除它名下的资料，只解除关联（资料降级为全局资料）——所以删物品后资料仍可用 `GET /docs?q=` 找到。

## 明确不碰的端点

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 134)May include surrounding context.

md
## 明确不碰的端点

以下端点与本技能无关，**不要调用**：
- 物品删除类：`DELETE /items/{id}`、`POST /items/{id}/purge`、`POST /items/purge-batch`、`POST /items/{id}/merge`、`POST /items/{id}/disable`
- 系统管理：`GET/PUT /settings`（含 AI 密钥）、`/license/*`、`/api-tokens*`、`/webhooks*`、`/notify/*`、用户管理
- 流水冲正：`POST /stock/records/{id}/reversal` —— 写错了请用户在界面操作冲正

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad, everyday terms such as “库存”, “入库”, “出库”, and “开始使用”, which can cause the skill to activate in conversations where the user did not intend to operate a live inventory system. Because this skill is capable of write actions against a user-provided IMS instance, unintended activation increases the chance of accidental stock changes or data modifications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents the skill reference in a single forced language, which can violate language/locale policy when no user opt-in or alternative is provided. Nothing in the file indicates that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 20)May include surrounding context.

list 内物品对象关键字段：id、internal_id（如 PRT-000123）、name、model、series、type、quantity（当前总量）、safety_stock、unit、location_id、location_path（如 A1-B2-3 库位链）、brand、supplier_id、tags、status、last_cost、avg_cost、params、thumbnail。

text
curl -s -H "Authorization: Bearer $XMT" "$BASE/api/v1/items?q=M3%E8%9E%BA%E4%B8%9D&page=1&page_size=20"

GET /items/{id} — 物品详情

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document is entirely written to conduct onboarding in Chinese and does not offer a language-selection step or fallback for users who may not read Chinese. This can cause users to misunderstand confirmation prompts and inventory-writing actions, increasing the risk of unintended configuration changes even though the content itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing instructions, trigger keywords, and prompt wording in this file are Chinese-only, and there is no indication that the skill supports language selection or that the Chinese locale is an intentional, documented constraint. This can violate language or locale policy when users are not given an opt-in choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Line L196 says to use the fallback when the user chooses "other" or when their answer does not match any scenario, but it does not define clear boundaries for what counts as a match failure. This creates a broad catch-all trigger that may absorb many normal conversations without clear scope or exclusion criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.