ClawHub
Back to skill

Security audit

Brand Monitoring

Security checks for vulnerabilities and agentic risk

Overview

This skill needs Review because it presents mostly demo or stub brand monitoring as real monitoring and recommends an unpinned global installer command.

Install only after the publisher provides a pinned, verifiable installer and clearly labels or implements live monitoring. Treat current reports as demo output, not reliable brand intelligence, and avoid running the global npx command with elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Package Execution During Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A second, broader description-behavior mismatch indicates undeclared functionality and multiple missing core features such as sentiment analysis, trend tracking, crisis detection, and competitor comparison. Misrepresentation of security-relevant or decision-supporting behavior reduces operator trust and can cause unsafe reliance on fabricated or incomplete monitoring results.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

A second, broader description-behavior mismatch indicates undeclared functionality and multiple missing core features such as sentiment analysis, trend tracking, crisis detection, and competitor comparison. Misrepresentation of security-relevant or decision-supporting behavior reduces operator trust and can cause unsafe reliance on fabricated or incomplete monitoring results.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises functionality that relies on network access but does not declare any explicit tool scope or permissions. This weakens reviewability and can lead to unexpected outbound access if the skill is installed or executed in an environment that grants broader defaults than intended.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

Using an unpinned 'npx skills' invocation introduces supply-chain risk because the fetched package/version can change over time. An attacker who compromises the package, a dependency, or resolves a malicious version could cause users to install or run unexpected code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The source-specific monitoring functions are placeholders that only print status messages and return empty results, while the skill promises basic no-API-key monitoring. This creates a deceptive operational state where users may believe monitoring is occurring when no live collection happens, undermining incident awareness and trust.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill’s advertised capability does not match its actual behavior: the main monitoring flow uses only demo mentions and never performs live collection from DuckDuckGo or Google News. In a security-sensitive agent ecosystem, this is dangerous because it can mislead users and downstream automations into trusting stale or fabricated monitoring coverage, causing missed detections or bad decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The CLI sets the output language to Chinese whenever the string "--zh" appears in the arguments, but it also treats the first non-flag argument as the brand name. This creates a locale-handling behavior where language selection is implicit and hard-coded to English/Chinese only, rather than clearly offering a user choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level docstring presents this file as brand-monitoring data scrapers for multiple data sources, and individual methods are documented as searches. In practice, the network calls and parsing are commented out for Reddit, Google News, and DuckDuckGo, while YouTube and Twitter only print notes and return empty results, contradicting the stated behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The request URL fixes the locale parameters to hl=en-US, gl=US, and ceid=US:en, which forces a specific language and region behavior. This is a natural-language locale policy concern because users are not offered a language/region choice and no region-specific justification is documented in the file.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrapers.py (reported line 118)May include surrounding context.

python
"""DuckDuckGo Search (Free，no API key)"""
    
    # DuckDuckGo Instant Answer API
    API_URL = "https://api.duckduckgo.com/"
    
    def search(self, query: str) -> List[SearchResult]:
        """Search DuckDuckGo"""

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest scope names Reddit, Google News, YouTube, and DuckDuckGo as the monitoring targets. This file adds a TwitterScraper and wires it into the unified search interface, extending the monitored platforms beyond the declared description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The inline comments describe real Reddit API or crawler usage, but the function body only returns an empty list. While not code execution or data theft, this is still a security-relevant integrity issue because misleading implementation comments can hide nonfunctional monitoring and cause reviewers or operators to overestimate coverage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.