ClawHub
Back to skill

Security audit

中文AI知识管理

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does the advertised knowledge-base work, but it needs review because manual install provenance is inconsistent and optional AI features can send logs or conversation dumps to external APIs.

Install only from the reviewed ClawHub package unless the maintainer clarifies the canonical repository. Before enabling --semantic or extract, assume selected log entries or conversation dumps will be sent to the configured AI provider, review/redact sensitive content, and keep heartbeat sync limited to intended workspace memory files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:30
Finding

Inconsistent Repository Ownership Creates a Supply-Chain Trust Ambiguity

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (47)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a multi-feature AI knowledge management skill, including deterministic classification plus deduplication, automatic tagging, and LLM extraction. The supplied code chunk only contains unit tests for classification-related behavior: sanitizing names, mapping configured prefixes to markdown file paths, handling unknown prefixes, and listing known prefixes. This partially aligns with the 'PREFIX deterministic classification' portion of the description, but the rest of the declared core capabilities are absent from this chunk. Because the actual code shown is narrowly focused on classifier testing and lacks evidence of the other advertised features, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description emphasizes AI-driven knowledge management features such as deterministic classification, deduplication, automatic tagging, and LLM extraction. The supplied code does not implement any of those behaviors; it is strictly a unit test for a config loader. It interacts with temporary directories, config JSON files, and environment variables to verify configuration defaults and merging behavior. While configuration support could be part of a larger system, this chunk’s actual purpose is materially different from the declared skill purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

代码内容仅为 dedup.test.js 测试文件，覆盖的实际能力集中在本地 hash 去重与状态文件维护：计算固定长度 hash、加载/保存 JSON 状态、检查重复、清理不存在文件的引用。它与声明中的“hash 去重”部分一致，但没有任何证据表明实现了确定性分类、语义去重、jieba 自动标签或 LLM 知识提取。由于声明描述的是一个更广泛的 AI 增强知识管理能力集合，而当前代码块仅展示其中较小且非 AI 的一部分，因此描述与该代码块实际行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

该代码块的主要功能是本地文件系统上的知识库统计与摘要：读取 kb/ 和 log/ 目录中的 Markdown 文件，统计条目数量、最早/最新日期、按目录汇总分布，提取近期日志中提到的主题并检查 kb/ 是否存在对应文件，还可生成 kb-index.md。与声明的“AI 增强知识管理”中列出的核心能力相比，代码没有体现确定性分类、去重、jieba 自动标签或 LLM 知识提取，且注释明确说明“纯本地统计，不调 LLM”。因此描述与实际行为存在明显不一致，属于实质性功能不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明描述的是一套以 AI 增强知识管理为核心的能力，重点包括分类、去重、自动标签和 LLM 提取。但提供的代码片段实际是测试代码，覆盖的行为是 analyzeFile / scanKbDir / generateDigest：递归扫描 md 文件、统计以特定标题模式开头的条目、提取最早/最新日期、生成“知识库摘要”、检测日志主题是否在知识库中缺失，以及生成 kb-index.md。这个行为与声明中的核心能力明显不一致。虽然同属知识管理领域，但该片段展示的主要目的更接近“知识库摘要与索引维护”，而不是声明中的 AI 分类、去重、标签和提取能力，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明描述的是一个较完整的 AI 增强知识管理能力集合，重点包括分类、去重、自动标签和 LLM 提取。而提供的代码片段只是在本地文件中解析特定 Markdown 日志格式，并扫描最近 N 天的日志文件。虽然其中的 prefix 字段与“PREFIX 确定性分类”有一定关联，但这里仅是从文本头部读取已有前缀，并没有实现分类逻辑本身。更重要的是，声明中的核心能力——hash/语义去重、jieba 自动标签、LLM 对话知识提取——在代码中完全没有出现。因此该代码行为与声明用途存在明显不一致，且代码的实际主要目的更接近“日志解析器/文件扫描器”而非完整的 AI 知识管理增强模块。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

从给出的代码块看，这是一个 parser 的单元测试文件，而不是实现 AI 增强知识管理核心能力的代码。它测试的实际行为主要是：从特定 Markdown/PREFIX 格式中提取 prefix、name、title、body、tags、date、raw；从文件系统中读取日志文件；按 YYYY-MM-DD.md 命名规则筛选最近若干天日志文件；以及从文本中提取 #标签。这与声明中的“确定性分类”只有部分相关，因为 PREFIX 解析可视为一种结构化分类方式，但声明的其余关键能力——hash/语义去重、jieba 自动标签、LLM 对话知识提取——在该代码块中完全没有体现。因此，描述与实际代码行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

代码仅包含 lib/synonyms.test.js 的测试用例，覆盖 normalize、normalizeTags、loadSynonyms 和 DEFAULT_SYNONYMS 的行为，例如将 DB/mysql 归一为“数据库”、将 Docker/k8s 归一为“容器”、标签去重和默认同义词表回退。这与声明中的一小部分“确定性分类/标签规范化”方向有弱相关，但并未看到 hash 去重、语义去重、jieba 分词打标、LLM 抽取等核心宣称能力。由于声明描述的是一个更完整的中文 AI 知识管理技能，而实际代码片段只是同义词标准化相关测试，属于主要功能描述与实际行为不一致。

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 83)May include surrounding context.

md
});

afterEach(() => {
    fs.rmSync(tmpDir, { recursive: true, force: true });
});

describe('E2E: sync 全流程', () => {
    it('从日志同步到知识库 - 完整流程', () => {
        const ws = setupWorkspace();
        const today = new Date().toISOString().slice(0, 10);

        writeLog(ws, today, `## 开发日志

### [PROJECT:数据报表] 自动化报表部署完成
crontab + Python 每日 8:00 推飞书。pandas 大表用 chunksize 避免 OOM。
#报表 #自动化 #pandas

### [INFRA:基础设施] Nginx 配置更新
upstream 增加 weight 参数实现加权负载均衡。
#nginx #运维

### [RESEARCH:微服务] Spring Cloud 调研笔记
Gateway + Nacos + Sentinel 三件套。服务间通信用 Feign 优于 RestTemplate。
#微服务 #架构 #spring
`);

        const config = loadConfig(ws);
        const logFiles = findLogFiles(config._logDirAbs, 7);
        assert.equal(logFiles.length, 1);

        const state = loadState(config._stat

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · lib/e2e.test.js (reported line 55)May include surrounding context.

js
});

afterEach(() => {
    fs.rmSync(tmpDir, { recursive: true, force: true });
});

describe('E2E: sync 全流程', () => {
    it('从日志同步到知识库 - 完整流程', () => {
        const ws = setupWorkspace();
        const today = new Date().toISOString().slice(0, 10);

        writeLog(ws, today, `## 开发日志

### [PROJECT:数据报表] 自动化报表部署完成
crontab + Python 每日 8:00 推飞书。pandas 大表用 chunksize 避免 OOM。
#报表 #自动化 #pandas

### [INFRA:基础设施] Nginx 配置更新
upstream 增加 weight 参数实现加权负载均衡。
#nginx #运维

### [RESEARCH:微服务] Spring Cloud 调研笔记
Gateway + Nacos + Sentinel 三件套。服务间通信用 Feign 优于 RestTemplate。
#微服务 #架构 #spring
`);

        const config = loadConfig(ws);
        const logFiles = findLogFiles(config._logDirAbs, 7);
        assert.equal(logFiles.length, 1);

        const state = loadState(config._stat

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · lib/parser.test.js (reported line 43)May include surrounding context.

js
pipeline', 'auto-tag']);
    });

    it('处理混合中英文标签', () => {
        assert.deepEqual(extractTags('#部署 #Docker #k8s #生产环境'), ['部署', 'Docker', 'k8s', '生产环境']);
    });
});

describe('parseLogContent - 基础解析', () => {
    it('解析标准 3 行格式', () => {
        const content = `### [PROJECT:数据报表] 自动化报表部署完成
crontab + Python 每日 8:00 推飞书。pandas 大表用 chunksize 避免 OOM。
#报表 #自动化 #pandas #飞书`;

        const entries = parseLogContent(content, '2026-02-24.md');
        assert.equal(entries.length, 1);
        assert.equal(entries[0].prefix, 'PROJECT');
        assert.equal(entries[0].name, '数据报表');
        assert.equal(entries[0].title, '自动化报表部署完成');
        assert.equal(entries[0].body, 'crontab + Python 每日 8:00 推飞书。pandas 大表用 chunksize 避免 OOM。');
        assert.deepEqual(entries[0].tags, ['报表', '自动�

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README promotes semantic deduplication and LLM-based extraction of conversation dumps using third-party AI providers, but it does not clearly warn that local logs, backups, or conversation content may be transmitted off-host to external services. In a knowledge-management skill, those inputs can easily contain sensitive operational data, credentials, internal discussions, or customer information, so the omission creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares it requires an API key and documents AI-enhanced commands, but it does not define an explicit tool/permission scope such as allowed network access or environment-variable access. That creates an authorization gap where an agent may invoke code with broader capabilities than users expect, especially because the skill also includes automated sync behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Natural-language content throughout the skill requires Chinese usage, including the title, description, and trigger phrases, but does not state that language selection is optional or limited for a justified regional reason. This can violate language/locale policy when users are not given an opt-in or alternative.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrase "知识库" is so broad that normal discussion about a knowledge base could unintentionally activate the skill. Because the skill can perform filesystem synchronization and may use optional AI/network features, accidental invocation can lead to unintended data processing or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The condition "用户要求从对话中提取知识" is ambiguous and can match many ordinary requests, creating a risk that the agent will summarize or export conversation content without clear user intent boundaries. In a memory/knowledge skill, that increases the chance of capturing sensitive information from chat and persisting it to disk or drafts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

A heartbeat-driven automatic sync with no stated scope or safeguards can cause background processing of logs without contemporaneous user approval. In this skill's context, automated ingestion of recent logs into a knowledge base materially increases the risk of silently persisting sensitive operational, personal, or business information, and optional AI features could amplify exposure if later enabled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The name, tagline, and description explicitly position the skill as Chinese-focused, including 'Chinese AI-enhanced' and 'Chinese auto-tagging', but the manifest does not indicate that users can opt into another language or that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/config.js (reported line 30)May include surrounding context.

js
provider: 'siliconflow',
            model: 'BAAI/bge-m3',
            apiKey: '${SILICONFLOW_API_KEY}',
            endpoint: 'https://api.siliconflow.cn/v1/embeddings',
            threshold: { suspect: 0.85, skip: 0.95 },
        },
        llm: {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · templates/km.config.json (reported line 23)May include surrounding context.

json
provider: 'siliconflow',
            model: 'BAAI/bge-m3',
            apiKey: '${SILICONFLOW_API_KEY}',
            endpoint: 'https://api.siliconflow.cn/v1/embeddings',
            threshold: { suspect: 0.85, skip: 0.95 },
        },
        llm: {

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The top-level comment says '纯本地统计，不调 LLM', which implies a read-only local analysis operation. However, when generateDigest is called with updateIndex enabled, it invokes updateKbIndex and writes kb-index.md to disk, so the module has a side effect beyond mere statistics generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file’s natural-language descriptions and test data are consistently written in Chinese, and the tests assert on Chinese strings throughout the suite. This effectively bakes a single language expectation into the skill behavior without any visible opt-in, alternative locale handling, or justification for a region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language prompt requires tags and domain terms to be in Chinese, and the system message further states the assistant is expert in Chinese extraction. This imposes a specific language/locale behavior without any visible opt-in or documented user choice in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The request messages instruct the model to behave as a Chinese knowledge-extraction expert and process/output content accordingly. This is a language-policy constraint visible in natural-language strings, and the file does not show any mechanism for user selection or consent to that locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code sends raw conversation/session dump content to a configurable external LLM endpoint, which can expose sensitive personal, business, or operational data outside the local environment. The risk is amplified because the endpoint is arbitrary/configurable and this file provides no consent gate, redaction step, allowlist, or disclosure before transmission.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.