ClawHub
Back to skill

Security audit

redbook-feedback-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core scraping and reporting purpose is coherent, but it includes under-disclosed browser-session control and an unreferenced remote LLM classifier with hardcoded authentication material.

Install only if you are comfortable giving the skill access to a logged-in browser session and allowing it to save scraped social-media content locally. Before use, remove the hardcoded API credentials, disclose or disable remote LLM classification, run scraping in an isolated browser profile, restrict CDP to a validated local endpoint, and require explicit approval before scheduled runs or KM document edits.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/llm_classify.py:10
Finding

Hardcoded Authentication Material and Stable User Identifiers

Content
View full analysis

Vulnerability Details

File Location: scripts/llm_classify.py, lines 10–18
Vulnerability Type: Hardcoded credentials and identity metadata
Risk Level: High

Vulnerable Code

python
BASE_URL = "https://mmc.sankuai.com/openclaw/v1"
MODEL = "catclaw-proxy-model"
HEADERS = {
    "Content-Type": "application/json",
    "Authorization": "Bearer catpaw",
    "X-Conversation-Id": "qlojc6j4vnqa35nznvl6",
    "X-User-Id": "jibowen04",
    "X-Scene": "CATCLAW",
}

Technical Analysis

The source code embeds an authorization value and stable user and conversation identifiers. Any person who can access the project can extract and replay these values without using the intended authentication flow.

If the bearer value is accepted by the configured API, requests made by unrelated users may be attributed to the hardcoded identity. Even if the bearer value has limited privileges, embedding it in source code prevents reliable secret rotation, encourages credential reuse, and makes authorization dependent on possession of the project files rather than an authenticated runtime identity.

The fixed X-User-Id and X-Conversation-Id values also undermine audit integrity because every installation submits requests using the same metadata.

Attack Path

  1. An attacker obtains a copy of the Skill package or reads the source repository.
  2. The attacker extracts the API URL, bearer value, user ID, conversation ID, and scene headers.
  3. The attacker constructs requests to https://mmc.sankuai.com/openclaw/v1/chat/completions using the extracted headers.
  4. If the server accepts the embedded authorization value, the attacker consumes the API under the hardcoded identity.
  5. Resulting activity may be billed, logged, or audited as activity belonging to the embedded user or conversation.

Impact Assessment

The maximum privilege available is determined by the server-side permissions granted to the em ...[truncated 492 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the bearer value and all user or conversation identifiers from source code.
  2. Immediately rotate or revoke the exposed bearer value if it is active.
  3. Obtain credentials from an approved secret manager or protected runtime environment variable.
  4. Derive user and conversation identifiers from the authenticated execution context rather than static constants.
  5. Apply server-side authorization independently of client-provided identity headers.
  6. Restrict the credential to the minimum required model, endpoint, quota, and lifetime.
  7. Add secret scanning to source-control and release pipelines.
  8. Review API logs for unexpected use of the exposed values.
  9. Remove the values from repository history and previously distributed packages where feasible.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/llm_classify.py:52
Finding

Undisclosed Transmission of Scraped User Content to a Remote API

Content
View full analysis

Vulnerability Details

File Location: scripts/llm_classify.py, lines 52–84
Vulnerability Type: Unclear external disclosure of collected user-generated content
Risk Level: Medium

Vulnerable Code

python
def classify_post(post):
    title = post.get('title', '')
    body = post.get('body', '')[:300]  # 限制长度
    text = f"标题：{title}\n正文：{body}"
    
    payload = json.dumps({
        "model": MODEL,
        "messages": [
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": text}
        ],
        "temperature": 0.1,
        "max_tokens": 200,
    }).encode('utf-8')
    
    req = request.Request(
        f"{BASE_URL}/chat/completions",
        data=payload,
        headers=HEADERS,
        method="POST"
    )
    
    try:
        with request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read())
            content = result['choices'][0]['message']['content'].strip()
            # 提取JSON
            match = re.search(r'\{.*\}', content, re.DOTALL)
            if match:
                return json.loads(match.group())
            return None
    except Exception as e:
        print(f"  Error: {e}", file=sys.stderr)
        return None

Technical Analysis

The classifier sends each scraped post title and up to 300 characters of its body to mmc.sankuai.com. The documented primary workflow in SKILL.md describes local analysis through analyze_feedback.py and does not clearly disclose this additional remote-processing path.

Scraped social-media content can contain names, telephone numbers, locations, order details, complaints, or other personal information. The truncation to 300 characters reduces volume but does not provide redaction or guarantee that sensitive information is excluded.

TLS protects the request in transit, but it does not address informed consent, data minimi ...[truncated 1379 chars]

Remediation
View remediation

Remediation Suggestions

  1. Clearly document that classification transmits post titles and excerpts to a remote service.
  2. Require explicit operator consent before enabling remote classification.
  3. Document the destination, data owner, retention period, access controls, and deletion process.
  4. Redact telephone numbers, account identifiers, addresses, order numbers, and other sensitive fields before transmission.
  5. Minimize submitted text to only the content required for classification.
  6. Provide and document a local-only classification option.
  7. Validate that the endpoint is an approved processor for the collected data.
  8. Avoid sending static personal identity headers; use an authenticated runtime identity only when required.
  9. Add configurable controls that allow remote processing to be disabled by default.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/xhs_search_scraper.mjs:26
Finding

Unrestricted CDP Endpoint and Unvalidated Debugger WebSocket URL

Content
View full analysis

Vulnerability Details

File Location: scripts/xhs_search_scraper.mjs, lines 26–34 and 242–257
Vulnerability Type: Unvalidated network endpoint and browser-control target
Risk Level: Medium

Vulnerable Code

javascript
const args = process.argv.slice(2);
const getArg = (name, def) => {
  const i = args.indexOf(name);
  return i !== -1 ? args[i + 1] : def;
};

const KEYWORDS = getArg('--keywords', '美团跑腿,跑腿,跑腿帮忙,美团帮忙,美团帮送,跑腿帮送,帮买,美团帮买').split(',').map(k => k.trim());
const DAYS = parseInt(getArg('--days', '3'));
const LIMIT = parseInt(getArg('--limit', '50'));
const OUT_DIR = getArg('--out', './output');
const CDP_URL = getArg('--cdp', 'http://127.0.0.1:9222');
javascript
let browser;
try {
  // 获取 WebSocket debugger URL
  const http = await import('http');
  const wsUrl = await new Promise((resolve, reject) => {
    http.get(`${CDP_URL}/json/version`, res => {
      let data = '';
      res.on('data', chunk => data += chunk);
      res.on('end', () => {
        try { resolve(JSON.parse(data).webSocketDebuggerUrl); }
        catch(e) { reject(e); }
      });
    }).on('error', reject);
  });
  browser = await chromium.connectOverCDP(wsUrl);
  console.log('✅ 已连接到本地 Chrome\n');
} catch (e) {
  console.error(`❌ 无法连接到 Chrome CDP (${CDP_URL}): ${e.message}`);
  process.exit(1);
}

Technical Analysis

The --cdp argument accepts an arbitrary string that is used as an HTTP destination. The response body is parsed and its webSocketDebuggerUrl field is trusted without checking its scheme, hostname, port, or relationship to the original endpoint.

Although the default URL points to loopback, that restriction is not enforced. A malicious wrapper, scheduled invocation, or operator-supplied argument can direct the initial request to an attacker-controlled server or an internal HTTP service. An attacker-controlled response can then provide a debugger WebSoc ...[truncated 1814 chars]

Remediation
View remediation

Remediation Suggestions

  1. Permit only loopback CDP endpoints by default, such as 127.0.0.1, ::1, or an explicitly approved local socket.
  2. Parse the value with the standard URL class and reject unsupported schemes, embedded credentials, fragments, and unexpected paths.
  3. Validate that the returned webSocketDebuggerUrl also uses an approved WebSocket scheme and resolves to an approved loopback host.
  4. Do not allow the returned WebSocket URL to redirect browser control to a different host unless an explicit secure configuration authorizes it.
  5. Check HTTP status codes and content type before parsing the response.
  6. Enforce a small maximum response size and a strict timeout.
  7. Prevent redirects or validate every redirect destination.
  8. If remote CDP support is necessary, require authenticated TLS, a host allowlist, and explicit operator confirmation.
  9. Run the scraper with a dedicated browser profile containing no unrelated authenticated sessions or sensitive browsing data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This mismatch includes an especially concerning undeclared capability: use of an external LLM API with embedded authentication headers. Undisclosed third-party data transfer and hardcoded authentication materially increase the risk of credential exposure, unreviewed data exfiltration, and operation outside expected trust boundaries.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This mismatch includes an especially concerning undeclared capability: use of an external LLM API with embedded authentication headers. Undisclosed third-party data transfer and hardcoded authentication materially increase the risk of credential exposure, unreviewed data exfiltration, and operation outside expected trust boundaries.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
node scripts/xhs_search_scraper.mjs \

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The dataset includes text advising users to claim sickness or work issues and to use family/company stamps that 'won't be checked strictly' to obtain refunds. Preserving and potentially surfacing such content in an agent skill creates a pathway for fraud enablement and can normalize or amplify deceptive conduct through downstream reports or reuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a feedback analysis tool that performs deep classification such as service type, sentiment, and feedback type, then outputs a Markdown report to a KM knowledge document. In this file, the implemented behavior is limited to collecting Xiaohongshu posts, applying a simple keyword relevance filter, and writing JSON to a local output directory.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares no explicit tool scope even though its documented workflow performs network access and file writes. This weakens least-privilege controls, making unintended scraping, outbound requests, or document modification harder to govern and increasing blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L03 的触发词包含“抓小红书”“分析用户评价”“舆情”等表述，这些短语缺少明确的产品、平台范围或任务边界，容易与一般性的研究、营销或舆情分析请求重叠。描述中也未提供排除条件或负例，难以判断该技能应在何种具体情境下激活。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file contains user-facing natural-language content exclusively in Chinese, and there is no indication that the skill offers language/locale selection or that the Chinese-only format is required for a region-specific compliance purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The keyword set includes broad everyday terms such as '帮买' and '跑腿' that are likely to match large amounts of unrelated or low-signal content. This expands collection scope unpredictably, increases ingestion of untrusted/off-topic text, and directly contributes to the polluted dataset seen elsewhere in the file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The output stores raw Xiaohongshu post bodies, URLs, and engagement data instead of only the summarized feedback artifacts promised by the skill. This unnecessarily retains third-party content and identifiers, increasing data exposure, copyright/privacy risk, and making downstream consumers process untrusted scraped text directly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The collected dataset contains many posts unrelated to genuine user feedback on the target 跑腿 product, including ads, personal side hustles, unrelated service discussions, and broad life-content matches. In a feedback-analysis skill, overbroad inclusion degrades integrity of the analysis and can cause misleading business decisions or unsafe downstream automation based on polluted data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The content celebrates a delivery practice of publicly announcing recipients' identities and purchases to a village, exposing personal relationships and buying behavior. In a monitoring skill, retaining or promoting such narratives without safeguards can normalize privacy-invasive service patterns and leak sensitive personal context to downstream users.

Content

No source excerpt is available for this finding.

Ssd 2

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The scraped text contains actionable advice for obtaining refunds via questionable pretexts and weakly verifiable documentation, which is a form of social-engineering/fraud guidance. In the context of an analysis skill, storing such instructions unfiltered increases the chance they are redistributed, quoted, or operationalized by users or downstream agents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring states the script is for '小红书跑腿舆情分析' and that the output is a structured Markdown report, and the implementation consistently emits Chinese-only report headings and labels. This imposes a specific language/locale on users without any opt-in, configuration, or documented regional justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script hardcodes a bearer token plus fixed user and conversation identifiers for an external LLM endpoint. That exposes reusable credentials in source code, enables unauthorized use or impersonation if the file is shared, and ties data processing to a specific identity without access controls; in this skill, the capability is directly used to send scraped post content off-platform, which raises both credential-abuse and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code transmits post titles and body text to an external LLM service without any consent prompt, disclosure, or data-minimization controls beyond a simple length cap. Even if the source content is public, the aggregated dataset and any embedded personal or sensitive details are being exfiltrated to a third party, creating privacy, compliance, and vendor-retention risks; the skill’s purpose is analysis, but that does not eliminate the need to disclose external processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script automatically connects to a Chrome DevTools Protocol endpoint and pulls the WebSocket debugger URL over HTTP, then attaches to an existing browser context that may carry the operator's authenticated sessions. In this skill context, that is more dangerous because the tool is explicitly designed to scrape a site that often requires login, so reusing a live browser session can expose cookies, account state, and unrelated open-browser data without clear user consent or isolation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest and file documentation describe filtering posts by specified dates or recent days, implying the requested date window controls collection scope. This loop automatically expands the window up to 30 days when results are insufficient, so the scraper may collect posts outside the originally requested date range.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code file performs a file write that persists collected Xiaohongshu post data as JSON. Although the script documents the --out parameter, it does not explicitly warn the user that scraped content and metadata will be saved locally, and there is no confirmation prompt before writing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

技能描述重点是对小红书跑腿类帖子做分析并输出 Markdown 报告写入 KM 学城文档，但该脚本实际只在本地输出目录创建并写入 report_*.md 文件。虽然生成 Markdown 报告与分析目的相关，但本地持久化这一具体行为与描述中的目标落点并不完全一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring and system prompt require the model interaction and output schema in Chinese, with no indication that language choice is configurable or intentionally limited to a region-specific workflow. This is a natural-language locale constraint that could violate organizational language-choice policy if users are not given opt-in.

Content

No source excerpt is available for this finding.