ClawHub
Back to skill

Security audit

ios moblink integration (iOS MobTech MobLink 集成 skill)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed iOS MobLink integration helper, with privacy-sensitive SDK setup that is mostly consent-gated and user-controlled.

Install this only for an iOS project where you intend to integrate MobTech MobLink. Review the proposed file changes before applying them, treat MOBAppSecret in Info.plist as client-exposed app configuration, confirm the privacy-consent callback carefully, and complete App Store/privacy disclosures before release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README explicitly references collection or control of sensitive identifiers and telemetry such as location, IDFA, IDFV, WiFi, and IP, but does not provide a clear user-facing warning, consent requirement, or implementation guardrails in this document. In the context of an integration skill, this can lead developers to wire up privacy-sensitive SDK capabilities without adequate disclosure or consent, creating compliance and privacy risk.

Static analysis

No suspicious patterns detected.