ClawHub
Back to skill

Security audit

VIN配件 模糊译码(车型)

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed VIN-and-parts lookup helper that calls a stated external API with a required API key.

Install only if you trust the JZ/qipeidao service with VINs, parts lists, and the API key used for this lookup. Treat VINs as potentially sensitive, use a scoped or dedicated API key where possible, and be aware that one README example has the wrong script filename.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Low
Confidence
78% confidence
Finding
The document declares the script path as skills/fuzzyoe/get_fuzzy_oe.py but the usage example invokes python3 skills/fuzzyoe/get_parts_epc.py. This contradiction can cause operators or agents to execute an unintended file, which is dangerous in a skill ecosystem because a mismatched path can hide different behavior than what the documentation describes, including unauthorized network calls or secret handling.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script transmits a VIN, parts names, and an API key to a third-party remote service without any user-facing disclosure, consent flow, or data-handling notice. VINs can be sensitive vehicle identifiers and, in some environments, may be linked to customers or internal records, so silent external transmission creates a real privacy and data-governance risk.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.