ClawHub
Back to skill

Security audit

Local Guide - Food & Travel

Security checks for vulnerabilities and agentic risk

Overview

This local travel recommendation skill is mostly coherent, but it includes unsafe shell execution from user-controlled search text that should be reviewed before installation.

Install only if you trust the publisher and are prepared to patch or avoid the shell-based search fallback. Configure EXA and Feishu credentials with least privilege, avoid using this skill with untrusted location/type text until shell=True is removed, and only enable Feishu output for intended chats or users.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 兜底实现
    import subprocess
    cmd = f"mcporter call exa.web_search_exa query='{query}' numResults={num_results}"
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout
Confidence
99% confidence
Finding
The fallback path builds a shell command with user-controlled input (`query`) and executes it with `shell=True`. This enables command injection if an attacker can supply crafted search text containing shell metacharacters, allowing arbitrary command execution in the skill's runtime environment.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill directs execution of an external shell command that pipes generated JSON into a Python script for Feishu delivery. Any instruction that expands a content skill into code execution and message delivery increases the attack surface, especially if user-controlled fields can flow into the JSON payload, command context, or downstream script behavior.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The file adds Feishu messaging capabilities that do not align with the stated purpose of a local recommendation skill. Out-of-scope communication features increase attack surface and can be abused to send data, notifications, or spam to external recipients if other parts of the skill pass untrusted content into this module.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
A local recommendation skill should perform searches through a defined API, but this fallback executes shell commands instead. Because the shell command incorporates untrusted search input, the fallback materially expands the attack surface from web lookup to arbitrary command execution.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill silently executes a shell command using user-derived query text with no disclosure or consent boundary. The main danger is not merely lack of warning, but that hidden shell execution on untrusted input can be abused to run arbitrary system commands.

External Transmission

Medium
Category
Data Exfiltration
Content
url = f"https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type={receive_id_type}"
        body = {"receive_id": receive_id, "msg_type": "interactive", "content": json.dumps(card)}

    r = requests.post(url, headers=headers, json=body)
    result = r.json()
    
    if result.get("code") == 0:
Confidence
74% confidence
Finding
This code can send arbitrary interactive card content to Feishu recipients, creating an external data transmission channel. In isolation this is a legitimate messaging feature, but in the context of a local recommendation skill it is unnecessary and could be repurposed to exfiltrate search results, user data, or operational details to chats/open IDs if upstream inputs are abused.

Static analysis

No suspicious patterns detected.