ClawHub
Back to skill

Security audit

Lingxing

Security checks for vulnerabilities and agentic risk

Overview

The Lingxing lookup workflow is coherent, but a missing dependency can trigger remote software installation without a separate approval step.

Review and approve CLI installation separately, preferably using a reviewed, pinned release. Check its automatic skill synchronization before allowing persistent changes across your agents. Connect only the intended Lingxing account and consider OOMOL's access to business data. The remote installers and hosted connector implementation were not verified; no malicious behavior was established.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The supplied chunk is solely a remote installer and contains no Lingxing-specific search, read, or integration behavior. Although installing a dependency can be a supporting implementation detail, this chunk provides no evidence that the installer supports the declared purpose. The downloaded script is not supplied, so its further behavior cannot be determined; no claim of malicious behavior is implied.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

Piping a remote HTTPS response directly into bash executes mutable installer code without checking a pinned version, signature, or independently trusted digest. If the distribution endpoint or its publishing pipeline is compromised, the script could access local secrets or modify files with the invoking user's privileges; the PowerShell alternative has the same underlying risk.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

The setup workflow executes downloaded installer scripts without warning about remote code execution or system changes.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The fallback setup instructs the agent to execute downloaded installation scripts without explicitly obtaining approval for local code execution and system changes. Although setup only applies when the CLI is missing, a read-oriented Lingxing request could consequently trigger software installation beyond the user's expected scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources