T08 · Insecure Dependencies
Warning
- Location
README.md:14- Finding
Unpinned ClawHub Package Execution in English Installation Guide
- Content
View full analysis
- Remediation
View remediation
Security audit
西瓜视频中视频采集
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a read-only Xigua data lookup helper, but its instructions can automatically route failures to unrelated Douyin endpoints and its data-sharing scope is under-disclosed.
Review before installing. Use this only if you are comfortable sending Xigua video IDs, user IDs, search terms, and comment lookup parameters to MaxHub/aconfig.cn with your API key. The publisher should remove or clearly separate the Douyin/Xiaohongshu references and pin the documented install command before this is treated as a clean Xigua-only skill.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README_CN.md:14- Finding
Unpinned ClawHub Package Execution in Chinese Installation Guide
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md | 禁止行为 | 正确做法 | |----------|----------| | ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 | | ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 | | ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 | | ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md | 禁止行为 | 正确做法 | |----------|----------| | ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 | | ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 | | ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 | | ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md | "analyze" / "分析一下" | Switch to analyze mode | | "compare with X" / "和X对比" | Add X as second query | ## Output Guidelines 1. **Language consistency** — ALL output matches user's detected language. 2. **Markdown links** — All URLs in `[text](url)` format.
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is branded and described as a Xigua-only assistant, yet its execution and downgrade logic includes Douyin and Xiaohongshu endpoints. That mismatch can silently route user queries and bearer-authenticated requests to unintended platform APIs, creating data-governance, consent, and policy-boundary violations.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md `GET /api/v1/xigua/app/v2/fetch_one_video` <!-- Full path: /api/v1/xigua/app/v2/fetch_one_video --> ### Parameters
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md `GET /api/v1/xigua/app/v2/fetch_one_video_v2` <!-- Full path: /api/v1/xigua/app/v2/fetch_one_video_v2 --> ### Parameters
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md `GET /api/v1/xigua/app/v2/fetch_user_post_list` <!-- Full path: /api/v1/xigua/app/v2/fetch_user_post_list --> ### Parameters
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md `GET /api/v1/xigua/app/v2/fetch_video_comment_list` <!-- Full path: /api/v1/xigua/app/v2/fetch_video_comment_list --> ### Parameters
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README advertises access to user data, posts, and comments, but provides no privacy notice, data handling disclosure, or warning that queries may transmit personal or behavioral data to a third-party service. In a data-access skill, this omission is security-relevant because users and integrators may expose personal information without informed consent or adequate governance.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to run
npx clawhub install maxhub-xiguawithout pinning a specific package version. This creates a supply-chain risk because users may unknowingly install a newly published or compromised version of the installer or dependency path, reducing reproducibility and increasing exposure to malicious updates.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example prompts list only "视频, 用户" (video, user), which are extremely broad everyday/domain-generic nouns rather than specific trigger phrases or constrained invocation examples. The README does not clarify what exact requests should activate the skill or provide exclusion examples, increasing the risk of ambiguous invocation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The installation command uses
npx clawhubwithout pinning an exact version, which allows whatever version is currently published to be fetched and executed at install time. If the upstream package is compromised, typo-swapped, or updated maliciously, users of this README could run unreviewed code on their systems.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The usage examples list extremely broad trigger phrases like '视频，用户', which are likely to overlap with ordinary conversation. In an agent or assistant environment, such vague triggers can cause accidental invocation of the skill, leading to unintended access to external APIs, user-related data queries, or unexpected tool execution.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill instructs sending user query parameters and a bearer token to an external third-party service. External transmission is expected for API-backed skills, but it remains security-relevant because ambiguous routing and inconsistent platform scoping increase the chance of sending data or credentials to destinations users did not intend.
- Content
md maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}" # GET example curl -s "https://www.aconfig.cn/api/v1/xigua/{endpoint}?{params}" \ -H "$maxhub_auth_header" # POST example
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill asserts it is a legitimate read-only Xigua assistant, but elsewhere documents fallback behavior to Douyin and Xiaohongshu paths. This inconsistency is dangerous because it can cause operators and users to misjudge the true data scope and destination of requests, weakening trust boundaries and compliance review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The routing table uses broad everyday trigger phrases such as search/find/show me, which can cause the skill to activate for ambiguous requests not clearly intended for this integration. Unintended invocation matters here because the skill is configured to autonomously execute external API calls with an authorization header.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction "ALL output matches user's detected language" imposes a language policy based on automatic detection rather than user preference. This can violate organizational language/locale policy because it forces a locale choice without explicit opt-in or an offered alternative.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation describes endpoints that retrieve personal profile information using a user identifier and send that identifier to a remote third-party service, but it does not warn operators about the privacy implications. In an agent skill context, this omission can cause users or calling agents to submit personal identifiers without informed consent or data-minimization checks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This endpoint lists a user's posted content from a remote service based on a user_id, but the documentation omits any warning that this is surveillance-adjacent personal data collection. Within an agent ecosystem, such omissions make it easier to automate bulk profiling or monitoring of an individual's activity without appropriate user awareness or policy checks.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The comment-list and search endpoints send user-supplied item IDs and keywords to an external service, yet the docs do not warn that queries and identifiers leave the local environment. While lower impact than direct profile lookup, this still creates privacy and confidentiality risk because search terms or watched items may reveal user interests or sensitive investigative activity.
- Content
Static analysis
No suspicious patterns detected.