ClawHub
Back to skill

Security audit

福利吧

Security checks for vulnerabilities and agentic risk

Overview

This forum skill mostly matches its stated purpose, but it handles login cookies unsafely and executes remote JavaScript during scraping.

Review before installing. Use a dedicated low-privilege forum account, keep cookie.txt tightly permissioned, avoid placing unrelated cookies in it, and do not use the skill on untrusted redirects or sensitive sessions unless the redirect parsing and cookie-origin checks are fixed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
lib/decode-redirect.js:12
Finding

Execution of Remotely Retrieved JavaScript in an Inadequate VM Sandbox

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
main.js:133
Finding

Forum Session Cookie Can Be Disclosed to Cross-Origin Redirect Destinations

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package.json:16
Finding

Unpinned Dependency Installation Without a Lockfile

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill metadata advertises read-only content retrieval, but the workflow also includes authenticated sign-in and local cookie-file updates, both of which are state-changing behaviors. Undisclosed account actions and credential-material handling are dangerous because users may invoke the skill expecting passive scraping while it modifies remote account state and local auth data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill metadata advertises read-only content retrieval, but the workflow also includes authenticated sign-in and local cookie-file updates, both of which are state-changing behaviors. Undisclosed account actions and credential-material handling are dangerous because users may invoke the skill expecting passive scraping while it modifies remote account state and local auth data.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs the AI to extract and surface cloud-storage links and passwords from scraped posts. In this context, that facilitates redistribution of potentially unauthorized access information and increases the likelihood of exposing pirated, private, or access-controlled content, making the forum-scraping context more dangerous rather than less.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill performs outbound HTTP requests to a third-party forum and follows redirects, but the capability is not reflected in the declared behavior/permissions. Undeclared network access is dangerous because it expands the skill's trust boundary, can transmit user-derived data such as cookies, and makes review and consent ineffective.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The published description says the skill retrieves and summarizes forum posts, but the code also contains account automation for forum sign-in. This hidden functionality is risky because it uses the user's authenticated session for state-changing actions that a reviewer or user would not reasonably expect from a read-only scraping skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Automated daily check-in is an authenticated, state-changing action unrelated to post listing/summarization. In this context, it is more dangerous because the skill asks for forum cookies and can operate on the user's account without a clear, justified need, creating risk of unauthorized actions and account policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions direct access to a local cookie.txt file containing authentication material without any user-facing disclosure about credential use, storage, or privacy impact. Handling session cookies silently can expose user accounts if the file is misread, overexposed to tools, or reused in unintended contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The check-in feature performs an authenticated account action on the target forum, but the skill text does not clearly warn users that invoking it will modify account state. This can lead to unintended actions performed under the user’s identity and reduces informed consent around remote side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code writes updated authentication cookies back to local storage, extending the lifetime and exposure of sensitive session credentials beyond what is needed for one scraping run. In a skill whose stated purpose is summarization, persistent credential storage is unnecessary and increases the chance of token theft, misuse, or accidental reuse for hidden actions like check-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The request headers hard-code accept-language to zh-CN,zh;q=0.9, which imposes a specific language/locale on all outbound requests. This is a natural-language policy concern because the skill does not offer any user choice or explain why the locale is required.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest exposes a checkin command that is not described in the skill's stated purpose of scraping forum content and summarizing posts. Hidden or undocumented capabilities increase risk because they may trigger additional network actions, authentication flows, or automated account activity outside user expectations, especially for a scraper targeting a third-party site.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json
"checkin": "node main.js checkin"
  },
  "dependencies": {
    "cheerio": "^1.1.2",
    "undici": "^7.15.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json
},
  "dependencies": {
    "cheerio": "^1.1.2",
    "undici": "^7.15.0"
  }
}

Unverifiable Dependency: undici has 16 known advisory(ies) (CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2024-24758 (Undici proxy-authorization header not cleared on cross-origin redirect in fetch) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
76% confidence
Finding

The manifest depends on undici without pinning to a known-safe version, while the package family has multiple advisories including request smuggling, response queue poisoning, and redirect-related header leakage. Because this skill performs network scraping, use of a vulnerable HTTP client is directly relevant and could expose requests, headers, or response handling to manipulation if an affected version is installed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.