🦞 大龙虾互助技能

• Outcome: Review
• Latest audit: May 28, 2026 · 8:22 AM UTC
• Version: 1.0.0

Overview

This plugin is openly built to store task experience and share help over a peer network, but it does so automatically and broadly enough that private prompts, tool data, and work details could be retained or shared without clear user control.

Install only in environments where task prompts, tool-call details, summarized results, host-identifying metadata, and help requests are acceptable to store locally and potentially share with other clients. Disable autoConnect unless you explicitly need peer help, avoid sensitive or proprietary tasks, review and clear the experience files, and prefer a version with opt-in logging, redaction, retention limits, authenticated private response channels, and per-request sharing approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code describes the response channel as private, but it is just a predictable name based on clientId, which itself includes the hostname and timestamp and is shared over the lobby/help network. Any party able to subscribe to Apinator channels can likely guess or observe the channel name and eavesdrop on or inject help responses, exposing sensitive solution content and enabling spoofed messages.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly says it will automatically record task descriptions, execution steps, success state, and generated tags after each task, but it provides no consent flow, sensitivity filtering, or warning that potentially confidential user data may be retained. This creates a privacy and data-retention risk because prompts, operational details, and tool traces can contain secrets, personal data, or proprietary information.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation describes broadcasting help requests and sharing experience over a network with other agents, but it does not warn users that data may leave the local system or explain what content is transmitted. Because the stored experience appears to include task descriptions and execution history, this can lead to unintended external disclosure of sensitive user or system information.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Session prompts and tool-call parameters/results are recorded and persisted to disk automatically, with no consent flow, redaction, or minimization. Those prompts and tool results can contain secrets, personal data, internal file contents, tokens, or proprietary material, so silent retention creates a substantial confidentiality risk even before any later sharing occurs.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The plugin sends task descriptions, tags, client identifier, and client name to an external network without an explicit warning or approval step. In this skill's context, task text may be derived from user prompts or operational issues and can easily contain confidential business information, credentials, internal hostnames, or personal data, making outbound transmission especially dangerous.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The default configuration enables the plugin and auto-connects to an external service as soon as it loads, before the user has reviewed what data may be sent or what channels will be joined. While connection alone is less severe than active exfiltration, it expands the attack surface immediately and normalizes silent network participation.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill's core workflow is to automatically capture natural-language task descriptions and execution-step histories, then index them for later retrieval and sharing. That creates a direct data leakage path because user prompts, tool call chains, and derived tags can embed secrets, internal procedures, URLs, file paths, and other sensitive context that may later be surfaced to other agents or users.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The mutual-aid design says the agent will broadcast help requests and share matched local experience with other online agents, which implies redistribution of previously collected user/task data across a network boundary. In this context, the feature materially increases danger because the earlier automatic logging makes the shared corpus likely to contain confidential information, and the receiving agents are outside the original trust boundary.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill's stated behavior is to retain summaries of completed tasks and to seek/share help with other clients, which establishes a designed pipeline for collecting and redisclosing session-derived information. In an agent environment, task summaries and tool outputs frequently contain sensitive context, so this design materially increases the risk of confidential data leakage to disk and over the network.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Captured prompts and tool results are converted into reusable 'experiences' and later used as the source of help responses sent to other clients. This creates a direct exfiltration path from local session data to external recipients, potentially disclosing secrets, internal paths, code, documents, API outputs, or other sensitive operational artifacts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "@apinator/client": "^2.0.0",
    "ws": "^8.20.0"
  },
  "devDependencies": {
    "@types/node": "^25.5.0",

• Confidence: 97% confidence
• Finding: The ws dependency is specified with a non-exact version range, which increases supply-chain risk, and the same package is also flagged separately as a known vulnerable version. In this context, imprecise pinning makes it easier for builds to drift and complicates verifying that a safe patched version is consistently installed.

Known Vulnerable Dependency: openclaw==2026.1.26 — 10 advisory(ies): CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r) +7 more

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The peer dependency allows openclaw >=2026.1.26, and the static analysis indicates 2026.1.26 has multiple known advisories including authentication and access-control weaknesses. Because this is the host framework the skill relies on, deploying it in an environment with a vulnerable OpenClaw version could expose the entire agent runtime to bypass, unauthorized access, or observer compromise.

Known Vulnerable Dependency: ws==8.20.0 — 1 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure)

Low

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The dependency list includes ws 8.20.0, which is flagged with a known memory disclosure advisory. If this skill uses WebSocket communication, an affected runtime could leak uninitialized memory to remote peers, which is especially relevant for agent plugins that may handle tokens, chat content, or other sensitive data in memory.

Static analysis

No suspicious patterns detected.