ClawHub
Back to skill

Security audit

url-manager

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real URL manager, but it needs Review because normal use can silently create a hosted account, save credentials locally, upload user content, and rely on an unpinned GitHub fallback script.

Install only if you are comfortable with this skill using ai.ocean94.com as a hosted storage service for saved links and notes. Before first use, confirm account creation and data upload with the user, avoid the GitHub fallback install path unless independently verified, and treat the local .token file and magic links as credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises operational behavior that includes network access, local token storage, shell commands, and file writes, but it does not expose a dedicated least-privilege permission model beyond metadata. That mismatch increases the chance an agent or user will invoke sensitive capabilities without clear trust boundaries or approval expectations.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The documentation instructs the agent to clone code from a remote GitHub repository and execute it if a local script is missing. This is a classic supply-chain risk: the repository contents could change, be compromised, or differ from the reviewed skill, leading to arbitrary code execution under the agent's privileges.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger language is extremely broad, covering common phrases like save, remember, or bookmark this. In an agent ecosystem, that can cause over-invocation of a networked skill that auto-registers accounts and uploads user data, even when the user did not intend to use an external service.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script automatically registers an account and persists the returned token to a local .token file without explicit user confirmation. In an agent skill context, this can create external accounts and durable credentials silently, which is risky for consent, auditability, and unintended data sharing to a third-party service.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
result = _raw_api("/register", method="POST", no_auth=True)
    if "token" in result:
        token = result["token"]
        os.environ["FOOTPRINTS_TOKEN"] = token
        try:
            with open(TOKEN_FILE, "w") as f:
                f.write(token)
Confidence
83% confidence
Finding
After automatic registration, the script stores the received bearer token both in memory and on disk, creating a durable credential without explicit user approval. In an agent-integrated workflow, this can lead to silent account creation and long-lived authentication material remaining on the host beyond the immediate task.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
## How to Use

**Zero setup — token auto-management.** The `footprints.py` script handles everything: reads `{baseDir}/.token`, auto-registers on first use, stores token locally with `chmod 600`. Just run any command and it works.

All commands via `python {baseDir}/scripts/footprints.py <subcommand> [--json]`. Add `--json` for machine-parseable output.
Confidence
90% confidence
Finding
The phrase 'Just run any command and it works' normalizes unrestricted invocation of a helper script that performs network actions, account registration, token management, and potentially destructive operations. In practice, this reduces safety checks around sensitive subcommands and encourages agents to execute actions without adequate validation or user consent.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
print(*args, **kwargs)


def api(path, method="GET", data=None, no_auth=False):
    """API 调用 + token 自动管理"""
    token = _get_token()
    if not token and not no_auth:
Confidence
74% confidence
Finding
The API wrapper automatically obtains a token by registering a new account if one is absent, making network-side identity creation the implicit default behavior. In a skill context, that is an unsafe operational default because ordinary reads can trigger account creation and credential issuance without explicit user intent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.