ClawHub
Back to skill

Security audit

知乎热榜 - UAPIPRO

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed helper for fetching Zhihu hot-list data through a third-party API, with no evidence of hidden persistence, destructive behavior, or unrelated data access.

Install only if you trust uapis.cn with your UAPIPRO API key and are comfortable with the skill making outbound requests to that service when fetching Zhihu hot-list data. The artifact appears narrow and disclosed, but it is Chinese-oriented and depends on a third-party API provider.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tainted flow: 'req' from os.environ.get (line 36, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihu_hot.py (reported line 42)May include surrounding context.

python
})

    try:
        with urllib.request.urlopen(req, timeout=10) as resp:
            data = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        raise RuntimeError(f"API请求失败 (HTTP {e.code}): {e.read().decode()}")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes code that needs environment access and outbound network access, but the manifest does not declare any tool scope or permission boundary. This creates an implicit capability grant, making it harder for reviewers and runtimes to enforce least privilege and increasing the chance the skill can access secrets or make external requests without clear user or platform visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says the skill requires UAPIPRO_API_KEY but does not clearly warn that using the skill sends requests and a bearer token to the third-party service uapis.cn. This can mislead operators or users about data flow and trust boundaries, causing accidental disclosure of credentials or user-derived query data to an external provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions require that every reply use a specific Chinese-language output format, which imposes a locale/language constraint by default. The file does not offer user opt-in or explain that the skill is intentionally limited to Chinese for a justified regional use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Feishu formatter hard-codes the post payload under the zh_cn locale key, and the script’s user-facing strings are also fixed in Chinese. This indicates a language/locale constraint without any user opt-in or documented justification, which matches the policy-violation category for forced language or locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.