ClawHub
Back to skill

Security audit

Kb Query

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed team knowledge-base query helper with bounded evidence reading and optional, policy-gated Q&A persistence to a Gitea repository.

Install this only where a bot account is intended to read the team KB and, when enabled, write curated QA pages. Use a least-privilege Gitea token scoped to the target KB repository, keep answerPolicy.writeHighValueAnswerToQa off unless persistence is desired, and ensure backend attachment storagePath values are limited to approved upload/shared directories.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill explicitly relies on environment variables, reads and writes shared files, and invokes scripts that can access a Gitea-backed knowledge base, yet no permissions are declared. This creates a dangerous mismatch between documented capability and actual behavior, reducing reviewability and making over-privileged execution or unintended data access more likely.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The client can write arbitrary content into the configured Gitea repository via upsert_text, which exceeds the core expectation of a KB query/read capability and creates an integrity-modification path. In this skill context, the presence of optional Q&A persistence makes write access somewhat explainable, but it is still dangerous because a compromised or misused skill could alter KB content, plant misleading answers, or overwrite trusted documents without an explicit trust boundary or authorization check in this code.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
Repository writes occur with no visible user-facing disclosure, confirmation, or audit-oriented control in this module, so users of a nominally question-answering skill may be unaware that their interactions can cause KB persistence or modification. In this skill context that mismatch increases the chance of silent content changes, especially if higher-level orchestration invokes persistence automatically.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The skill hard-codes a required references section heading in Chinese ("## 参考来源") via the instruction payload, which can force the downstream agent to answer in a specific locale or at minimum append output in a language the user did not request. This creates a prompt-level policy conflict that can degrade usability, mislead users about expected language, and interfere with systems that assume output language follows user preference or deployment policy.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.