ClawHub
Back to skill

Security audit

播客深度提取转文字

Security checks for vulnerabilities and agentic risk

Overview

The podcast workflow fits its purpose, but setup asks you to paste an API key into chat despite assurances about local credential handling.

Configure CUE_API_KEY locally yourself and avoid the instructions asking you to paste it into chat. Revoke and replace any key already shared. Podcast links go to Cue, transcripts are processed by the model, and parsing consumes service credits; verify retention terms before submitting sensitive content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

The setup workflow requires users to disclose their API key in chat despite claiming the agent cannot view it and that key handling stays local.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The mandatory setup instructions tell users to paste their complete API key into the conversation, contradicting the claims that the agent cannot view it and that key handling remains local. This exposes the credential to conversation storage and processing systems; anyone obtaining it could potentially consume the user's paid service credits. The later suggestion to rotate a disclosed key does not prevent the initial exposure.

Content

No source excerpt is available for this finding.

The setup script instructs the agent to solicit a complete API key in conversation under the pretext of configuring the service.

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

The skill explicitly directs the agent to solicit a complete authentication secret as part of onboarding, creating an unnecessary credential-disclosure path. This is the same underlying issue as the SDI-4 finding, not a separate compromise. Although the key is legitimately needed for the service, it does not need to pass through the conversation, and the content does not establish malicious intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
CUE_KEY=$(python3 -c "import json,os;p=os.path.expanduser('~/.cue/config.json');print(json.load(open(p)).get('api_key','') if os.path.exists(p) else '')" 2>/dev/null || true)
CUE_KEY=${CUE_KEY:-$CUE_API_KEY}
echo "=== 1/3 API Key ===" && { [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！"; }
echo "=== 2/3 远程端点 ===" && curl -sS --max-time 10 -X POST "https://mcp.cuecue.cn/api/omni-reader/mcp/" \
  -H "Authorization: Bearer $CUE_KEY" \
  -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
- **确认是单集链接**（见上表）。给的是专辑/主页链接 → 请用户换单集链接。
- **清理跟踪参数**：去掉 `?utm_source=`、`?_sonic=`、`&from=` 等，保留核心路径与 ID。
- **展开短链**：`xima.tv/xxxx` 等短链先用 `curl -s -o /dev/null -w "%{url_effective}" -L "<短链>"` 跟随重定向拿到最终 URL 再提交。
- **时长预判**：按上表告知用户预计耗时。

### 步骤 1：提交解析（远程端点）

Static analysis

No suspicious patterns detected.