ClawHub
Back to skill

Security audit

品牌GEO分析

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed GEO brand-analysis workflow that sends user-selected questions to RedFox-backed AI search endpoints and saves local analysis/report files, with privacy handling as the main caveat.

Install only if you are comfortable sending brand names, categories, custom questions, and generated prompts to RedFox-backed AI search services and storing the raw answers in local output files. Avoid confidential launches, regulated data, secrets, customer data, or non-public competitive strategy in questions unless your organization permits that data flow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The supplied code is specifically a report generator (geo_report.py). It loads analysis_result.json and optionally search_results.json, calls generate_html(...), saves an HTML file, and prints a summary. The declared description presents the skill as an end-to-end GEO analysis tool that automatically asks multiple AI engines and analyzes their responses. Those core behaviors are absent from this code chunk. While HTML report generation is consistent with part of the description, the actual code’s primary purpose is materially narrower: post-processing already-generated results into a report. Therefore this chunk does not accurately represent the broader declared functionality.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/lib/analyzer.py (reported line 449)May include surrounding context.

python
请确保输出是合法 JSON，不要包含注释或额外文本。"""

    return prompt


def merge_analysis(deterministic, ai_analysis):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill prominently describes submitting questions to six external AI platforms but does not provide a clear user-facing privacy warning about what data is transmitted, stored, or exposed to third parties. This is dangerous because users may include confidential brand strategy, internal benchmarks, or sensitive prompts that are silently sent to multiple external services with different retention and logging practices.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README says users can 'just describe what you need in natural language' without defining tight trigger boundaries or explicit scope constraints. In an agent setting, this can cause the skill to activate on ambiguous requests and perform unintended multi-platform external submissions, increasing the chance of accidental data disclosure or misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README encourages users to invoke the skill with broad natural-language requests such as asking to analyze a brand's AI-search performance, without clearly constraining when the skill should activate versus when a general assistant should respond normally. In an agent ecosystem, overly broad trigger guidance can cause unintended activation on loosely related requests, increasing the chance of unnecessary external actions, bulk querying of third-party platforms, or processing sensitive brand/business data without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares no explicit tool scope or permissions while instructing use of environment variables, local file reads/writes, and networked calls to multiple third-party services. This weakens least-privilege boundaries and makes it harder for users or the host system to understand and constrain what the skill can access, increasing the risk of unintended data exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes broad terms such as GEO, 品牌可见度, and AI搜索引擎优化, which can cause the skill to activate for generic conversations unrelated to informed GEO analysis. Overbroad activation is dangerous here because the workflow sends user-supplied queries to multiple external AI/search platforms and writes local output files, potentially causing unintended data sharing or unexpected external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description and workflow do not prominently warn users that their provided brand, industry, and generated questions will be sent to six third-party AI/search platforms. In this context, omission is risky because user inputs may contain confidential business strategy, product launch plans, or sensitive competitive research, and the skill normalizes broad external dissemination without explicit informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language instructions, help text, and output guidance entirely in Chinese, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or the constraint is clearly documented and justified as region-specific, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The tool automatically sends user-supplied queries to multiple third-party AI/search platforms, but the code provides no explicit user-facing warning that inputs will leave the local environment. In this skill context, users may submit confidential brand monitoring questions, internal campaign plans, or sensitive competitive intelligence, making silent transmission to six external services a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persists all submitted queries and returned AI-search content to a JSON file under the output directory without any consent prompt, redaction, or warning. Because GEO analysis may include proprietary brand strategy, customer data, or sensitive research prompts, writing full contents to disk can create unintended local data exposure through shared workspaces, backups, logs, or later exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file’s natural-language content is entirely in Chinese, including the module description and the AI analysis prompt template. The file does not offer any language choice or indicate that the skill is region-specific, which can violate language/locale policy requiring user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The prompt constructed in this function is written entirely in Chinese and assumes Chinese-language operation for downstream analysis. Because no opt-in, locale parameter, or justification is present, this is a natural-language locale policy issue rather than a code-security issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/platforms.py (reported line 94)May include surrounding context.

python
url = f"{API_BASE}{config['submit_path']}"

    for attempt in range(max_retries + 1):
        resp = requests.post(
            url,
            json={"inquiry_text": query, "source": source or SOURCE_TAG},
            headers=_get_headers(),

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/platforms.py (reported line 133)May include surrounding context.

python
url = f"{API_BASE}{config['submit_path']}"

    for attempt in range(max_retries + 1):
        resp = requests.post(
            url,
            json={"inquiry_text": query, "source": source or SOURCE_TAG},
            headers=_get_headers(),

Tainted flow: 'task_id' from requests.post (line 103, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/lib/platforms.py (reported line 133)May include surrounding context.

python
config = PLATFORMS[platform]
    url = f"{API_BASE}{config['result_path']}"

    resp = requests.post(
        url,
        json={"taskId": task_id},
        headers=_get_headers(),

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The generated HTML sets lang="zh-CN", which forces a specific language/locale in the output. The file also consistently emits Chinese labels and copy, but does not provide any user opt-in, locale selection, or documented justification for restricting output to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The natural-language instructions and usage guidance are entirely in Chinese, which effectively forces a specific language for users without any opt-in or stated locale limitation. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file is entirely presented in Chinese and gives no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy rule for language/locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.