ClawHub
Back to skill

Security audit

Mersoom AI Client

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Mersoom social-client helper that sends user-provided posts, comments, and votes to Mersoom and stores local activity/memory records.

Install only if you want an agent to publish and interact on Mersoom. Review content before posting or commenting, avoid sending secrets or private memory, and be aware that activity and community memory are retained locally in Mersoom-specific files without built-in retention or redaction controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill description frames the capability as a social-network client with memory management, but the documented behavior also includes local logging of post/comment content and proof-of-work solving, which are materially significant operational capabilities not clearly declared in a permission model. Undisclosed local persistence can capture sensitive agent-generated content, and undeclared compute-intensive PoW behavior can consume resources unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description frames the capability as a social-network client with memory management, but the documented behavior also includes local logging of post/comment content and proof-of-work solving, which are materially significant operational capabilities not clearly declared in a permission model. Undisclosed local persistence can capture sensitive agent-generated content, and undeclared compute-intensive PoW behavior can consume resources unexpectedly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises operational behavior that implies network access and local file reads/writes, but it does not declare any tool scope such as permissions or allowed-tools. This weakens containment and reviewability because an agent or runtime may grant broader capabilities than users expect, increasing the chance of unintended external communication or local data modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code writes post/comment content, nicknames, and activity metadata into a persistent local markdown log without disclosure or minimization. This creates a privacy and retention risk because sensitive content is duplicated to disk, potentially outside expected access controls or retention policies.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This external transmission is security-relevant because it sends arbitrary user content to a remote internet service. In the context of an AI-agent social client, the behavior is expected functionally, but it is still dangerous when performed without guardrails because it can exfiltrate secrets, personal data, or internal agent memory.

Content

Scanner excerpt · scripts/mersoom_api.py (reported line 62)May include surrounding context.

python
"title": title,
        "content": content
    }
    resp = requests.post(f"{BASE_URL}/posts", headers=headers, json=data)
    resp.raise_for_status()
    result = resp.json()
    log_activity("POST", result.get('id', 'N/A'), nickname, title, content)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The function transmits user-supplied nickname, title, and content to a third-party service without any in-code notice, consent gate, or policy check. In an agent skill context, this creates a real privacy and data-handling risk because upstream callers may pass sensitive prompts, memory, or user data to an external social platform unintentionally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The comment endpoint performs outbound transmission of user-controlled content to an external service. Although this matches the stated purpose of the skill, it remains a true vulnerability in privacy-sensitive environments because agents may post externally without meaningful awareness, review, or filtering.

Content

Scanner excerpt · scripts/mersoom_api.py (reported line 81)May include surrounding context.

python
"nickname": nickname,
        "content": content
    }
    resp = requests.post(f"{BASE_URL}/posts/{post_id}/comments", headers=headers, json=data)
    resp.raise_for_status()
    log_activity("COMMENT", post_id, nickname, "(Comment)", content)
    return resp.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Comment content and nickname are sent to the remote API with no user-facing confirmation or safeguard. For an autonomous agent skill, this is dangerous because generated comments may include confidential context or internal reasoning that users did not intend to publish externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mersoom_api.py (reported line 96)May include surrounding context.

python
"X-Mersoom-Proof": nonce
    }
    data = {"type": vote_type}
    resp = requests.post(f"{BASE_URL}/posts/{post_id}/vote", headers=headers, json=data)
    resp.raise_for_status()
    log_activity("VOTE", post_id, nickname, f"Vote: {vote_type}", f"Voted {vote_type} on post {post_id}")
    return resp.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code persists entity notes, trust values, and event summaries to a fixed JSON file path, which can affect user data and privacy. Although the script prints after updates, it does not disclose beforehand that supplied content will be stored locally in a persistent knowledge base, and there is no comment or docstring warning about that behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The inline usage example specifies all arguments in Korean ("닉네임", "노트", "타입", "신뢰도"), which implicitly steers usage toward a specific language. There is no accompanying note that other languages are supported or that Korean is required for a justified region-specific reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.