ClawHub
Back to skill

Security audit

Init User

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent, but it needs review because it uses a site-admin Gitea token to make persistent repository changes for user-supplied Gitea usernames without proving the requester controls that account.

Install only in an environment where you control the Gitea instance and can tolerate a site-admin token being used by this skill. Before use, verify the Gitea server addresses, replace the admin token with the least-privilege account possible, add a way to prove the Feishu user controls the claimed Gitea account, pin dependencies, and avoid logging Feishu identifiers unnecessarily.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This module centralizes use of a site-admin Gitea token and exposes functions that can create repositories for arbitrary users via admin endpoints. In an agent skill context, that is dangerous because any higher-level workflow that invokes these helpers can perform privileged actions across the Gitea instance, enabling unauthorized repo creation and broader abuse if the skill is misused or compromised.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The code creates repositories and writes repository contents using privileged credentials, but this module contains no built-in disclosure, consent, or policy checks before performing those actions. In a skill setting, hidden write-side effects are risky because users or calling agents may not realize they are triggering persistent changes in a remote system under an admin identity.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The module reads a sensitive admin token from environment variables and automatically uses it for outbound API requests to the configured Gitea server. While accessing environment-based secrets is common, in this skill context the secret directly enables privileged network actions, and there is no in-module guardrail to prevent silent misuse of those credentials.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script returns feishu_app_token and feishu_table_id in stdout after updating the user record. In agent/tooling environments, stdout is commonly captured in logs, orchestration traces, chat transcripts, or downstream tool outputs, which can unintentionally disclose these identifiers to operators or other components that do not need them. The skill context increases risk because the script is explicitly designed for automation via OpenClaw, making output propagation and logging likely.

Credential Access

High
Category
Privilege Escalation
Content
# Gitea 服务器地址（注意确认是哪台服务器！末尾不要带斜杠）
GITEA_URL=http://43.156.243.152:3000

# 机器人账号的 Access Token
# 要求：该账号必须是 Gitea 站点管理员（管理后台→用户管理→勾选"是管理员"）
# Token 权限范围：repo 读写、admin 写、user 读
GITEA_ADMIN_TOKEN=在这里填入token
Confidence
98% confidence
Finding
Access Token

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28
python-dotenv>=1.0
Confidence
97% confidence
Finding
requests>=2.28

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28
python-dotenv>=1.0
Confidence
96% confidence
Finding
python-dotenv>=1.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
requests

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
71% confidence
Finding
python-dotenv

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.