ClawHub
Back to skill

Security audit

Lingxing

Security checks across malware telemetry and agentic risk

Overview

This Lingxing connector is mostly coherent, but it is framed as read-only while allowing broad ERP tool calls that may change business data.

Review before installing. This skill should be treated as a general Lingxing ERP connector, not a read-only search skill. Only use it where you are comfortable with the agent discovering and invoking Lingxing tools, and require explicit confirmation for any tool call that could create, update, overwrite, or delete ERP data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The manifest markets the skill as limited to 'searching and reading data', but the documented `call_tool` action can invoke arbitrary Lingxing ERP tools, including tools that may create or update records. This mismatch can cause an agent or user to treat the skill as read-only and invoke it in contexts where write-capable behavior is unsafe, enabling unintended state changes in an ERP system.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The safety section says untagged actions are reads and safe to run directly, yet `call_tool` is untagged while its own description warns that some Lingxing tools create or update ERP data. This contradictory guidance undermines operator safeguards and can lead an autonomous agent to execute a write operation without confirmation because it was misclassified as read-only.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger scope says to use this skill for ANY Lingxing request, which is broader than necessary and increases the chance of automatic invocation in situations where direct API use, another narrower skill, or additional user confirmation would be more appropriate. Combined with the write-capable `call_tool` action, broad routing increases the risk of accidental exposure to sensitive ERP operations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.