ClawHub
Back to skill

Security audit

sn-search-social-media

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed public-search helper that sends search terms to public web APIs and has ordinary dependency and privacy considerations, but no evidence of hidden persistence, credential theft, or destructive behavior.

Before installing, treat searches as public: do not enter secrets, private incident names, unreleased product details, or customer data as queries. Install dependencies in a virtual environment and consider pinning httpx for reproducible installs. The skill is Chinese-language and intentionally refuses crypto/blockchain/Web3 topics.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Related Location: SKILL.md:24-31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Vulnerable Code Snippet:

text
httpx>=0.27

The related installation instruction in SKILL.md is:

bash
python3 -m pip install -r requirements.txt

Technical Analysis

The dependency specification defines only a minimum version and does not impose an upper bound, exact version, lock file, or package integrity hash. Consequently, each installation can resolve to a different and potentially unreviewed future release of httpx and its transitive dependencies.

The package is legitimate and is required by the Skill's HTTP-based search scripts. The risk arises from non-reproducible dependency resolution rather than evidence that the currently available package is malicious. If a future matching release or transitive dependency is compromised, the installation and subsequent import process could introduce attacker-controlled code into the Agent's Python environment.

Attack Path

  1. An attacker compromises a future release of httpx, one of its transitive dependencies, or the package distribution channel.
  2. The Agent follows the documented installation command.
  3. Package resolution selects the latest version satisfying httpx>=0.27.
  4. The compromised package is installed without hash verification.
  5. A search script imports httpx through scripts/search_utils.py.
  6. Malicious package code executes with the permissions of the Python process running the Skill.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the privileges of the Agent process. Depending on the surrounding runtime, this may permit access to files, environment variables, network resources, and other data available to that process. The impact is limited by the operating-system permissions and iso ...[truncated 200 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin httpx to an exact version that has been reviewed and tested:
    text
    httpx==<reviewed-version>
  2. Generate and commit a reproducible lock file covering all transitive dependencies.
  3. Require verified package hashes, for example by using pip install --require-hashes.
  4. Update dependencies through a controlled review process that includes vulnerability scanning and compatibility testing.
  5. Install dependencies inside a dedicated virtual environment or sandbox rather than the Agent's shared Python environment.
  6. Configure package installation to use only a trusted package index and reject unexpected alternate sources.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/wikimedia_pageviews.py (reported line 44)May include surrounding context.

python
def _get_json(url: str) -> dict:
    req = Request(url, headers={"User-Agent": USER_AGENT, "Accept": "application/json"})
    with urlopen(req, timeout=20) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

声明描述的是一个面向多类信息源的广泛搜索能力，包括社区、社媒、新闻热点、百科趋势、开发者生态和技术讨论。但实际代码的功能范围明显更窄：它只访问 GitHub 搜索 API，并且只搜索 repositories 或 issues，属于开发者生态/技术讨论中的一个子集。因此描述高估了数据源和覆盖范围。此外，代码还实施了未在描述中体现的限制：拒绝加密货币相关查询。虽然核心方向与“开发者生态和技术讨论”部分部分吻合，但整体声明与实际行为存在实质性不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

声明描述的是一个覆盖社区、社媒、新闻热点、百科趋势、开发者生态和技术讨论的广义搜索能力，但实际代码只调用 Stack Exchange 的 advanced search 接口，属于较窄的开发者问答/技术讨论搜索。它并未实现社交媒体、新闻或百科趋势搜索，因此实际功能范围明显小于声明的多源搜索用途。此外，代码还加入了对加密货币相关查询和标签的拒绝、以及对结果的加密货币内容过滤，这属于描述中未提及的行为。虽然“开发者生态和技术讨论”与代码部分吻合，但整体描述未准确反映该技能的实际、主要行为。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The exception message is written only in Chinese: "该技能不处理加密货币/区块链/Web3 相关查询". For a general-purpose code module, forcing a single language in user-visible text without user opt-in or documented locale scope can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/github_public_search.py (reported line 16)May include surrounding context.

python
from _filters import CryptoQueryError, filter_crypto_items, reject_crypto_query


API_BASE = "https://api.github.com/search"


def _truncate(text: str, max_len: int = 240) -> str:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains user-facing natural-language strings entirely in Chinese for the argument parser description and help messages. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains natural-language documentation and user-facing messages entirely in Chinese, including the module docstring and dependency-installation guidance. The policy scope includes language or locale violations across all file types, and this file does not offer an opt-in, fallback, or justification that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill for searching communities, social media, news hotspots, encyclopedia trends, developer ecosystems, and technical discussions. This implementation is much narrower: it only queries the Stack Exchange API, defaults to Stack Overflow, and rejects cryptocurrency/blockchain/Web3 queries, which is a substantive behavioral limitation not conveyed by the manifest description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The code is explicitly designed to contact an external API endpoint, which creates an external data transmission boundary. In the context of a search skill, this is expected behavior, but it still carries privacy risk because user queries and metadata leave the local trust boundary and are sent to a third party.

Content

Scanner excerpt · scripts/stackexchange_search.py (reported line 18)May include surrounding context.

python
from _filters import CryptoQueryError, filter_crypto_items, reject_crypto_query


API_URL = "https://api.stackexchange.com/2.3/search/advanced"


def _strip_html(value: str) -> str:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The natural-language strings for the command description and argument help are written only in Chinese, which imposes a specific language on users without opt-in or alternative locale handling. This matches the policy category for language or locale constraints that are not optional or explicitly justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as httpx>=0.27, which permits any future release and does not ensure reproducible builds. This can introduce vulnerable or breaking versions into the environment over time and makes it difficult to verify exactly which package version is deployed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
httpx>=0.27

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
86% confidence
Finding

Because httpx is not pinned, it is not possible to determine from this manifest whether installation will resolve to a version affected by known advisories. In a skill that searches social media, news, and developer ecosystems, the HTTP client may process attacker-controlled remote content or redirects, so uncertainty around vulnerable versions increases supply-chain and input-handling risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes a skill for searching communities, social media, news trends, encyclopedia trends, developer ecosystems, and technical discussions broadly. This file’s documented and implemented behavior only searches GitHub public repositories or issues via the GitHub Search API, which is a much narrower capability than the stated skill scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The argument parser description and help strings are written only in Chinese, which imposes a specific language on users of this skill. The file does not offer an English alternative, locale selection, or any documentation that this is a region-specific tool, so it matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script sends the user's search query to a third-party service (Stack Exchange) without any explicit user notice, consent flow, or privacy warning in the tool interface. If users provide sensitive internal terms, credentials, or proprietary incident details as queries, that data is externally disclosed outside the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This Python file contains user-facing natural-language strings in Chinese for the argument parser description and help messages. That imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.