ClawHub
Back to skill

Security audit

iwown device gnss tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real GNSS lookup helper, but it can reveal a device’s location from an IMEI without clear ownership checks or consent.

Install only if you will use it for devices you own or are explicitly authorized to locate. Treat IMEIs and returned locations as sensitive personal data, and be aware the skill sends the IMEI to an external iwown endpoint and may return raw location data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill performs outbound network access to a third-party API but does not declare any corresponding permission or capability boundary. This is dangerous because it hides data egress behavior from reviewers and users, especially when the transmitted value is an IMEI tied to a physical device and its location lookup.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior says the skill identifies QR codes and queries location, but the included code also returns the full raw API payload and omits the actual QR parsing implementation. This mismatch is dangerous because it can expose more device/location data than users expect and prevents accurate security review of the real data extraction flow.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs sending an IMEI/device identifier to an external API to retrieve last known location, but provides no warning or consent flow about transmitting sensitive device data off-platform. In this context, the data is highly privacy-sensitive because it enables tracking a device's physical whereabouts through a third-party service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends a device IMEI to a third-party GNSS endpoint and retrieves precise location data without any visible user consent, authorization check, or disclosure. In the context of a skill specifically designed to identify a device from a QR code and return its location, this enables access to sensitive geolocation information tied to a unique device identifier, creating a significant privacy and surveillance risk if invoked on someone else's device.

Static analysis

No suspicious patterns detected.