ClawHub
Back to skill

Security audit

话袋笔记 Skill

Security checks across malware telemetry and agentic risk

Overview

This notes skill mostly matches its stated purpose, but it needs review because its scripts can send notes and the API key to an environment-overridden API URL despite documenting a fixed destination.

Install only if you are comfortable sending note content, search queries, and your Huadai API key to the Huadai service. Before use, check that HUADAI_BASE_URL is unset or exactly the intended Huadai API URL, and avoid saving secrets or highly sensitive material unless you trust the service and its data handling.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases for save/search actions are broad everyday expressions, increasing the chance the agent invokes the skill when the user did not intend to access or modify notes. In a note-taking skill with write capabilities, accidental routing can cause unintended storage of private conversation content or unintended queries against personal data.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The routing table uses ambiguous examples like generic save/search/update wording without robust disambiguation rules. This can cause overbroad activation and unintended note creation, search, or update actions, especially in multilingual or conversational contexts where such phrases appear casually.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends the user-provided search query and receives note data from a remote third-party API, but it provides no explicit user-facing disclosure at the point of use that personal note content and search terms will leave the local environment. In a note-taking skill, queries and returned content can contain sensitive personal information, so silent transmission creates a privacy and consent risk even if the network call is functionally required.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script sends user-provided note content and an API key to a remote service via curl, but provides no explicit transmission warning, confirmation, or data-sensitivity check at the point of upload. In a note-taking skill, users may paste secrets, personal data, or internal information, so silent exfiltration to a third-party API creates a real privacy and data-handling risk even if the behavior is core to the feature.

External Transmission

Medium
Category
Data Exfiltration
Content
"

# --- 调用 API ---
RESP=$(curl -sS -w '\n%{http_code}' \
  -X POST "$BASE_URL/block/upload-block" \
  -H "Authorization: $API_KEY" \
  -H "Content-Type: application/json" \
Confidence
91% confidence
Finding
curl -sS -w '\n%{http_code}' \ -X POST "$BASE_URL/block/upload-block" \ -H "Authorization: $API_KEY" \ -H "Content-Type: application/json" \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.