ClawHub
Back to skill

Security audit

YiMa StarEngine

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent sales analytics assistant, but it handles sensitive business/order data and advertises silent local caching without enough disclosure or user control.

Before installing, confirm what 巨量百应 data the skill can read, where any local cache is stored, how long it persists, and how to disable or clear it. Treat generated reports and promotional content as drafts, and avoid running the advertised CLI against real order or commission data until the implementation and data-handling policy are available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:138
Finding

Unpinned Remote Skill Installation Allows Mutable Payload Retrieval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:138-141; duplicate installation guidance appears in CLAWHUB_README.md:137-140
Vulnerability Type: Unverified installation of a mutable remote payload
Risk Level: Medium

Complete Code Snippet (SKILL.md:138-141):

bash
# 1. Install
easyclaw skills install https://clawhub.ai/myc1020/staring

# 2. Match influencers
python cli.py influencer match --category "Beauty"

Equivalent Code Snippet (CLAWHUB_README.md:137-140):

bash
easyclaw skills install https://clawhub.ai/myc1020/staring

python cli.py influencer match --category "Beauty" --min-level A
python cli.py script fabe --product "Perfect Diary Lipstick" --price 99

Technical Analysis

The documentation directs users to install a Skill directly from a remote URL. The reference is not pinned to an immutable version, commit, content digest, or cryptographically verified release. Consequently, the content retrieved at installation time can differ from the three documentation files reviewed during this audit.

The audited artifact does not include the advertised implementation, cli.py, dependency manifests, API client, or verification metadata. It is therefore impossible to establish that the remote package corresponds to the reviewed artifact or that future downloads will retain the same behavior.

Although no malicious payload is present in the audited files, this installation pattern creates a remote payload substitution risk: compromise of the publisher account, distribution service, DNS or delivery infrastructure could cause users to install attacker-controlled Skill content.

Attack Path

  1. An attacker compromises the remote Skill publisher account, ClawHub listing, or relevant delivery infrastructure.
  2. The attacker replaces the downloadable Skill with modified instructions, scripts, or dependencies.
  3. A user follows the documented easyclaw skills install com ...[truncated 955 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable URL with an immutable release identifier, signed tag, commit hash, or content-addressed package digest.
  2. Publish a SHA-256 or stronger digest through an independently trusted channel and require the installer to verify it before activation.
  3. Cryptographically sign releases and configure EasyClaw to reject missing, invalid, revoked, or untrusted signatures.
  4. Include the complete Skill implementation, including cli.py, scripts, configuration, and dependency lockfiles, in the artifact submitted for audit.
  5. Pin all transitive dependencies to reviewed versions and use integrity metadata where the package ecosystem supports it.
  6. Display the package origin, resolved immutable version, requested capabilities, and verification result before installation.
  7. Run newly installed Skills with least privilege, restricted filesystem access, network allowlists, and explicit approval for sensitive tool calls.
  8. Maintain reproducible builds and provide provenance metadata so users can confirm that distributed packages correspond to reviewed source code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly promotes direct connections to core business APIs and a silent fallback to local caching, but provides no disclosure about what data is cached, how long it is retained, who can access it, or whether sensitive business/order data may persist on disk. In a sales and order-analytics context, silent degradation to local storage can expose commercial data, personal information, or stale analytics without user awareness, increasing privacy, confidentiality, and decision-integrity risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill as Chinese-language only, with no indication that users can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The markdown includes concrete install and CLI usage commands that appear to run automated matching and promotional content generation, but it does not warn users about possible data processing, outbound requests, or business-impacting automation. For markdown files, user-facing descriptions should disclose behaviors that may affect user data or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains only Chinese-language content and does not provide any user opt-in, alternative locale, or justification that the skill is intended solely for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.